alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Observed ClickFix Loader Inbound"; flow:established,to_client; http.stat_code; content:"200"; http.response_body; content:"function _0x"; nocase; startswith; content:"function __gethiddenurl()"; fast_pattern; nocase; content:"win_ts"; nocase; content:"1f1d1a2f"; nocase; content:"04534170"; nocase; content:"abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz0123456789+/="; nocase; content:"decodeuricomponent"; nocase; content:"cf-used-at"; nocase; classtype:exploit-kit; sid:2071397; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2026_08_05, deployment Perimeter, malware_family ClickFix, performance_impact Low, confidence High, signature_severity Major, tag Exploit_Kit, tag compromised_website, updated_at 2026_08_05, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1189, mitre_technique_name Drive_by_Compromise;)