ClickFix: Clipboard hijack lure with copy-paste-to-terminal instruction

type.inbound

// message contains links
and 0 < length(body.links) < 15

// NLU detects credential theft intent
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name in ("cred_theft") and .confidence in ("medium", "high")
)

// REQUIRED: email must contain explicit copy-paste-to-terminal instruction
// or keystroke-only variant (e.g. press Windows+R, Ctrl+V, Enter) — UAT-11795/ClickFix
and (
  (
    strings.icontains(body.current_thread.text, "copy")
    and (
      strings.icontains(body.current_thread.text, "paste")
      or strings.icontains(body.current_thread.text, "pasting")
    )
    and regex.icontains(body.current_thread.text,
                        '(?:terminal|powershell|command prompt|run dialog|win(?:dows)?\s*\+\s*r|\bcmd\b|mshta)'
    )
  )
  or (
    // keystroke-only variant — no copy/paste language, just key instructions
    regex.icontains(body.current_thread.text,
                    '(?:ctrl\s*[+-]\s*v|press win(?:dows)?\s*\+\s*r)'
    )
    and regex.icontains(body.current_thread.text,
                        '(?:terminal|powershell|command prompt|run dialog|win(?:dows)?\s*\+r|\bcmd\b|mshta)'
    )
  )
)

// require 1 additional supporting signal
and 1 of (

  // fake CAPTCHA or browser verification framing
  regex.icontains(body.current_thread.text,
                  '(?:captcha|verify you are human|human verification|browser check|press windows|press win\s*\+\s*r|i am not a robot)'
  ),

  // link resolves to or redirects through a suspicious TLD
  any(body.links,
      .href_url.domain.tld in $suspicious_tlds
      or any(ml.link_analysis(., mode="aggressive").redirect_history,
             .domain.tld in $suspicious_tlds
      )
  ),

  // freemail sender — should never send terminal instructions
  sender.email.domain.domain in $free_email_providers
)

// negate highly trusted sender domains unless they fail DMARC
and not (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    // and org_domains
    or sender.email.domain.domain in $org_domains
  )
  and coalesce(headers.auth_summary.dmarc.pass, false)
)