CRPx0 ClickFix Pre-Execution Beacon to relay.php

Ibrahim Saud@tektrix

•updated Sep 14, 2026•1•0•1

Detects the early-stage HTTP beaconing behavior of the CRPx0 ClickFix social engineering campaign. This rule monitors for specific request patterns to 'relay.php' that include session identifiers and indicators of the lure, such as 'WINUPDATE_TRACK' or 'CAPTCHA_WEB'. This signal represents the initial interaction with the malicious infrastructure before the victim is coerced into running commands.