GitHub org impersonation page followed by github.io fake download portal

Ibrahim Saud@tektrix

•updated Sep 22, 2026•3•0•11

Detects a suspected ClickFix phishing sequence where a user navigates to a brand-impersonating GitHub organization or repository, followed by a redirection within a short timeframe to a GitHub Pages portal hosting malicious content. The rule also monitors for direct navigation to a known common lure-hosting domain.