ClickFix Stage-2 Payload Retrieval from mnl[.]ac Staging Infrastructure

Ibrahim Saud@tektrix

•updated Sep 18, 2026•1•0•1

Detects network activity associated with the 'ClickFix' campaign, specifically targeting the domain 'mnl.ac' and its associated infrastructure (IPs 149.255.35.135 and 45.74.7.27). The rules monitor for DNS queries, HTTP requests to fetch configuration files (configuration.ps1), and general outbound TCP connections that characterize the staging phase of the ClickFix PowerShell execution chain.