alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Observed ClickFix Loader Inbound"; flow:established,to_client; http.response_body; content:"__getHiddenURL()"; fast_pattern; content:"ParseInt"; distance:0; content:"lastvisit"; nocase; content:"navigator.userAgent"; reference:url,medium.com/@personal_42798/layered-obfuscation-and-execution-gating-in-a-javascript-loader-8d21c9fb14d6; classtype:trojan-activity; sid:2069301; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2026_05_14, deployment Perimeter, deployment SSLDecrypt, malware_family ClickFix, confidence High, signature_severity Critical, tag compromised_website, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2026_05_14, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1105, mitre_technique_name Ingress_Tool_Transfer; target:dest_ip;)