Researchers report a real, active malware operation where compromised websites use “ClickFix” style prompts to trick people into manually pasting and running malicious commands. The result is a multi-stage infection that downloads additional payloads and ultimately runs TELEPUZ, which can steal browser data and execute commands remotely. The lure looks like a normal “browser error/software update/CAPTCHA fix,” but it’s actually instructions to run attacker-provided commands.
This attack uses a technique known as ClickFix, where a compromised website displays a fake browser error, software update prompt, or CAPTCHA verification. Instead of a normal click-through fix, the page instructs the visitor to copy a command into their clipboard and paste it into PowerShell or the Windows Run dialog. Because the malicious script is injected into the clipboard and the victim is guided to paste and execute it themselves, this method is also called pastejacking.
Once the victim runs the pasted command, PowerShell downloads a second-stage payload from a remote URL and executes it. This chain ultimately launches TELEPUZ via rundll32.exe. TELEPUZ has been spreading through compromised sites using this lure since late April 2026, with campaign components retrieved from a specific attacker-controlled domain.
The strength of ClickFix lies in shifting the actual execution step to the victim. Traditional security controls that look for malicious downloads or attachments can miss this pattern because the user is the one pasting and running the command, often believing they are resolving a routine technical issue like a browser error or CAPTCHA glitch. The instructions are framed as helpful, everyday troubleshooting steps rather than obviously suspicious actions.
TELEPUZ also builds in resilience: if its direct command-and-control communication fails, it can retrieve fallback C2 details from public platforms such as Telegram, Steam, DNS, and even a Polygon smart contract. This layered approach to command-and-control makes the malware harder to fully disrupt even if one channel is blocked.
TELEPUZ itself is capable of keystroke logging, taking screenshots, stealing cookies, and executing further commands once it is running, so the consequences of following one of these prompts can extend well beyond the initial site visit.
Organizations across all roles, including executives, finance, HR, customer support, and IT helpdesk staff, should be trained to recognize that a legitimate website fix never requires pasting and running commands. Employees should be encouraged to close the tab and report unexpected verification or error pages rather than following the on-screen steps. Reinforcing that manual, user-driven actions can still deliver malware is central to resisting ClickFix-style lures like the one used to distribute TELEPUZ.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
ClickFix is a technique where compromised websites trick users into manually pasting and running malicious commands disguised as fixes for fake browser errors, software updates, or CAPTCHA verifications. This chain is used to deliver TELEPUZ malware.
TELEPUZ supports data theft and remote control actions such as keystroke logging, screenshots, cookie theft, and command execution.
The ClickFix lure leads to PowerShell execution, which downloads and runs a second-stage payload that ultimately launches TELEPUZ via rundll32.exe.
Be suspicious of any website instructing you to copy, paste, and run a command, especially in PowerShell or the Windows Run dialog, to fix a browser error or verify a CAPTCHA.
You’re on a site, a fake CAPTCHA fails, and a box pops up: “To fix this error, copy this command and run it.” That’s a real ClickFix trick spreading TELEPUZ right now. The page even injects a PowerShell command into your clipboard, so when you paste, it quietly pulls malware from hurgadatour.shop and launches it with rundll32. Once TELEPUZ is in, it can log your keystrokes, grab screenshots and cookies, and even pull backup control details from Telegram, Steam, DNS, or a Polygon smart contract if its main server is down. If any website tells you to copy and run a command to fix a browser error or CAPTCHA, stop. Close the tab and report it to IT, never paste their command.
AhnLab reports Larva-24009 has continued phishing campaigns through 2026, sending emails that trick employees into opening fake “document” attachments that are actually shortcut (LNK) files. When opened, the attachment runs hidden PowerShell commands, shows a decoy document, and silently downloads…
Microsoft observed real-world campaigns where victims were tricked by “ClickFix” prompts into pasting a command into Windows Run, which then installed ACR (Amatera) Stealer. The malware steals saved browser passwords, live session tokens, and Microsoft 365/OneDrive/SharePoint files, meaning…
Researchers documented a real macOS data-stealing campaign that relies on social engineering instead of software bugs. Victims are sent to a fake “verification” page that tells them to copy and paste a command into Terminal, which silently installs a stealer and then pressures them to enter their…
Researchers observed a real macOS information-stealing campaign that tricks victims into pasting a command into Terminal from a “ClickFix” web page. After running, the malware shows a fake macOS password prompt and can repeatedly crash key apps (Finder/Dock/browsers) for hours or days to pressure…
Ukraine’s CERT says the Russia-linked Sandworm group is tricking targets into infecting their own PCs using compromised websites that display fake CAPTCHA checks. Victims are instructed to copy and paste a PowerShell command, which downloads malware and can lead to deeper compromise. CERT also…
Researchers described an active phishing campaign that tricks people with fake Adobe/Zoom update and “document review” themes to install the legitimate ScreenConnect remote-access tool. Once installed, attackers get persistent remote control of the victim’s computer while blending in as normal IT…
