ClickFix: Clipboard hijack lure with copy-paste-to-terminal instruction

 1name: "ClickFix: Clipboard hijack lure with copy-paste-to-terminal instruction"
 2description: |
 3  Detects emails delivering ClickFix social engineering lures — messages that
 4  instruct the recipient to copy and paste a command into their terminal, Run
 5  dialog, or PowerShell, typically combined with a fake CAPTCHA, browser error,
 6  or verification prompt. ClickFix attacks use JavaScript to silently replace
 7  clipboard contents, causing the user to unknowingly execute a malicious command.
 8  Active campaigns in 2026 include TELEPUZ (April 2026+), which uses this
 9  technique to deliver a modular MaaS payload via a ClickFix-VIDAR chain.  
10type: "rule"
11severity: "high"
12source: |
13  type.inbound
14  
15  // message contains links
16  and 0 < length(body.links) < 15
17  
18  // NLU detects credential theft intent
19  and any(ml.nlu_classifier(body.current_thread.text).intents,
20          .name in ("cred_theft") and .confidence in ("medium", "high")
21  )
22  
23  // REQUIRED: email must contain explicit copy-paste-to-terminal instruction
24  // or keystroke-only variant (e.g. press Windows+R, Ctrl+V, Enter) — UAT-11795/ClickFix
25  and (
26    (
27      strings.icontains(body.current_thread.text, "copy")
28      and (
29        strings.icontains(body.current_thread.text, "paste")
30        or strings.icontains(body.current_thread.text, "pasting")
31      )
32      and regex.icontains(body.current_thread.text,
33                          '(?:terminal|powershell|command prompt|run dialog|win(?:dows)?\s*\+\s*r|\bcmd\b|mshta)'
34      )
35    )
36    or (
37      // keystroke-only variant — no copy/paste language, just key instructions
38      regex.icontains(body.current_thread.text,
39                      '(?:ctrl\s*[+-]\s*v|press win(?:dows)?\s*\+\s*r)'
40      )
41      and regex.icontains(body.current_thread.text,
42                          '(?:terminal|powershell|command prompt|run dialog|win(?:dows)?\s*\+r|\bcmd\b|mshta)'
43      )
44    )
45  )
46  
47  // require 1 additional supporting signal
48  and 1 of (
49  
50    // fake CAPTCHA or browser verification framing
51    regex.icontains(body.current_thread.text,
52                    '(?:captcha|verify you are human|human verification|browser check|press windows|press win\s*\+\s*r|i am not a robot)'
53    ),
54  
55    // link resolves to or redirects through a suspicious TLD
56    any(body.links,
57        .href_url.domain.tld in $suspicious_tlds
58        or any(ml.link_analysis(., mode="aggressive").redirect_history,
59               .domain.tld in $suspicious_tlds
60        )
61    ),
62  
63    // freemail sender — should never send terminal instructions
64    sender.email.domain.domain in $free_email_providers
65  )
66  
67  // negate highly trusted sender domains unless they fail DMARC
68  and not (
69    (
70      sender.email.domain.root_domain in $high_trust_sender_root_domains
71      // and org_domains
72      or sender.email.domain.domain in $org_domains
73    )
74    and coalesce(headers.auth_summary.dmarc.pass, false)
75  )  
76tags:
77  - "Attack surface reduction"
78attack_types:
79  - "Malware/Ransomware"
80  - "Credential Phishing"
81tactics_and_techniques:
82  - "Evasion"
83  - "Social engineering"
84  - "Scripting"
85detection_methods:
86  - "Content analysis"
87  - "Natural Language Understanding"
88  - "Sender analysis"
89  - "URL analysis"
90references:
91  - "https://www.elastic.co/security-labs/telepuz-maas-malware-clickfix"
92  - "https://www.microsoft.com/en-us/security/blog/2026/04/30/email-threat-landscape-q1-2026-trends-and-insights/"
93  - "https://yanaivanov.com/writing/clickfix_field_note.html"
94id: "df51b2bb-8f40-51b0-ae6f-ed742cf00109"