Beacon/staging HTTP callbacks to known AMOS-linked Codex ClickFix infrastructure

Emiliano Mema@Nosalva

•updated Aug 26, 2026•1•0•2

Detects HTTP traffic communicating with known domains (grove-12.com and trekmesh15.com) associated with the Codex ClickFix/AMOS campaign, specifically looking for indicators of payload staging or beaconing activity through specific URI patterns.