ClickFix Beacon: HTTP Request with event=pasted Parameter

Emiliano Mema@Nosalva

•updated Aug 28, 2026•11•0•7

Detects outbound HTTP GET/POST requests containing 'event=pasted' in the query string or URL, often directed at paths like '/api/metrics/run'. This pattern is associated with 'ClickFix' or 'AMOS' second-stage beaconing, where an adversary confirms a victim has successfully executed a social-engineered command (e.g., via copy-paste into a terminal) before proceeding with further payload delivery.