This rule detects inbound emails delivering ClickFix social engineering lures that instruct recipients to copy and paste a command into a terminal, Run dialog, or PowerShell. It targets campaigns like TELEPUZ (2026) that chain ClickFix to a Vidar-based modular payload and rely on clipboard hijacking to execute commands. Detection requires: (1) at least one link in the email (1–14 links); (2) a credential-theft intent identified by NLU with medium or high confidence; (3) explicit copy-paste-to-terminal instructions or a keystroke-only variant (e.g., Ctrl+V and Windows+R) directing execution in a terminal-like environment (terminal, PowerShell, cmd, mshta, etc.); and (4) one supporting signal such as a fake CAPTCHA/verification prompt, a link resolving to a suspicious TLD, or a freemail sender. The rule also excludes highly trusted senders unless DMARC fails. This combination reduces false positives from legitimate IT communications and trusted domains. Detection leverages content analysis, NLU, sender analysis, and URL/link analysis, aligning to attack surface categories around social engineering, evasion, and scripting. References point to Elastic Security Labs’ Telepuz/ClickFix analyses and 2026 threat landscape notes. The rule is configured as high severity with a focus on Malware/Ransomware and Credential Phishing use cases, reflecting ongoing ClickFix-based campaigns that hijack clipboard content to trigger command execution.