CRPx0 ClickFix Lure Telemetry Beacon - X-Captcha-Track Header

Ibrahim Saud@tektrix

•updated Sep 18, 2026•3•0•7

Detects outbound HTTP requests to 'relay.php' that include the 'X-Captcha-Track: 1' header, which serves as a telemetry beacon for the CRPx0 ClickFix social engineering campaign. This activity is indicative of a user interacting with a malicious webpage designed to trick them into executing harmful commands via copy-paste actions.