ClickFix: Clipboard hijack lure with copy-paste-to-terminal instruction

name: "ClickFix: Clipboard hijack lure with copy-paste-to-terminal instruction"
description: |
  Detects emails delivering ClickFix social engineering lures — messages that
  instruct the recipient to copy and paste a command into their terminal, Run
  dialog, or PowerShell, typically combined with a fake CAPTCHA, browser error,
  or verification prompt. ClickFix attacks use JavaScript to silently replace
  clipboard contents, causing the user to unknowingly execute a malicious command.
  Active campaigns in 2026 include TELEPUZ (April 2026+), which uses this
  technique to deliver a modular MaaS payload via a ClickFix-VIDAR chain.
type: "rule"
severity: "high"
source: |
  type.inbound
  
  // message contains links
  and 0 < length(body.links) < 15
  
  // NLU detects credential theft intent
  and any(ml.nlu_classifier(body.current_thread.text).intents,
          .name in ("cred_theft") and .confidence in ("medium", "high")
  )
  
  // REQUIRED: email must contain explicit copy-paste-to-terminal instruction
  // or keystroke-only variant (e.g. press Windows+R, Ctrl+V, Enter) — UAT-11795/ClickFix
  and (
    (
      strings.icontains(body.current_thread.text, "copy")
      and (
        strings.icontains(body.current_thread.text, "paste")
        or strings.icontains(body.current_thread.text, "pasting")
      )
      and regex.icontains(body.current_thread.text,
                          '(?:terminal|powershell|command prompt|run dialog|win(?:dows)?\s*\+\s*r|\bcmd\b|mshta)'
      )
    )
    or (
      // keystroke-only variant — no copy/paste language, just key instructions
      regex.icontains(body.current_thread.text,
                      '(?:ctrl\s*[+-]\s*v|press win(?:dows)?\s*\+\s*r)'
      )
      and regex.icontains(body.current_thread.text,
                          '(?:terminal|powershell|command prompt|run dialog|win(?:dows)?\s*\+r|\bcmd\b|mshta)'
      )
    )
  )
  
  // require 1 additional supporting signal
  and 1 of (
  
    // fake CAPTCHA or browser verification framing
    regex.icontains(body.current_thread.text,
                    '(?:captcha|verify you are human|human verification|browser check|press windows|press win\s*\+\s*r|i am not a robot)'
    ),
  
    // link resolves to or redirects through a suspicious TLD
    any(body.links,
        .href_url.domain.tld in $suspicious_tlds
        or any(ml.link_analysis(., mode="aggressive").redirect_history,
               .domain.tld in $suspicious_tlds
        )
    ),
  
    // freemail sender — should never send terminal instructions
    sender.email.domain.domain in $free_email_providers
  )
  
  // negate highly trusted sender domains unless they fail DMARC
  and not (
    (
      sender.email.domain.root_domain in $high_trust_sender_root_domains
      // and org_domains
      or sender.email.domain.domain in $org_domains
    )
    and coalesce(headers.auth_summary.dmarc.pass, false)
  )
tags:
  - "Attack surface reduction"
attack_types:
  - "Malware/Ransomware"
  - "Credential Phishing"
tactics_and_techniques:
  - "Evasion"
  - "Social engineering"
  - "Scripting"
detection_methods:
  - "Content analysis"
  - "Natural Language Understanding"
  - "Sender analysis"
  - "URL analysis"
references:
  - "https://www.elastic.co/security-labs/telepuz-maas-malware-clickfix"
  - "https://www.microsoft.com/en-us/security/blog/2026/04/30/email-threat-landscape-q1-2026-trends-and-insights/"
  - "https://yanaivanov.com/writing/clickfix_field_note.html"
id: "df51b2bb-8f40-51b0-ae6f-ed742cf00109"