Malware deployed via new ClickFix attack variant using Silk Road founder as lure

Summary: A January 2025 campaign used interest in Ross Ulbricht to draw people from impersonating social-media accounts into a fraudulent Telegram verification flow.

SC Media reported that the supposed identity check prompted visitors to execute a copied PowerShell command. It described the resulting download as a suspected Cobalt Strike loader; that identification should remain qualified. The report does not establish how many people were infected.

Why the verification request matters

An October 2024 alert from the U.S. Department of Health and Human Services describes the broader ClickFix technique: fake error or human-verification prompts persuade users to execute code themselves. That earlier alert provides background, not an investigation of this particular Telegram campaign.

CNB Telecom’s practical takeaway

Treat a verification screen that asks you to run commands as a warning sign. Check unexpected instructions through a separately trusted channel. Organizations should make suspicious prompts easy to report and investigate any command execution promptly. These are CNB Telecom’s recommendations, not evidence that this campaign affected CNB systems.

Original sources

• SC Media — campaign report, January 23, 2025
• U.S. HHS, Health Sector Cybersecurity Coordination Center — ClickFix Attacks, October 29, 2024 (background)

Independently summarized and reviewed by CNB Telecom

Archive review: November 2, 2026. The original publication date is retained; this is a historical report.