Rule Document 1:67008

Rule Category

MALWARE-OTHER --

Alert Message

MALWARE-OTHER Js.Infostealer.ClickFix download attempt

Rule Explanation

This rule triggers on an obfuscated javascript payload that is used for a phishing attack. It specifically is looking for the XOR decryption loop used commonly by ClickFix to obfuscate malacious intent.

What To Look For

This rule triggers on an obfuscated javascript payload that is used for a phishing attack

Known Usage

Attacks/Scans seen in the wild

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group