Tesseract OCR Typosquat Campaign — ClickFix Multi-Stage Malware Targeting Developers via Fake OCR Tool Sites with PowerShell Payload Chaining and Defense Evasion — Threadlinqs Intelligence
As of 2026-05-30, Tesseract OCR Typosquat Campaign — ClickFix Multi-Stage Malware Targeting Developers via Fake OCR Tool Sites with PowerShell Payload Chaining and Defense Evasion is a high-severity malware threat attributed to a N/A-nexus actor, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 16 indicators of compromise.
Threat ID: TL-2026-0162 · Severity: HIGH · Status: SUPERSEDED · Category: MALWARE
Attribution: N/A · FINANCIAL
A targeted phishing campaign impersonates the legitimate Tesseract OCR open-source project (60K+ GitHub stars) through typosquatted domains, using ClickFix-style social engineering to trick developers
A sophisticated malware campaign targets developers and power users searching for Tesseract OCR — the widely-used open-source Optical Character Recognition engine originally developed by HP Labs and later maintained by Google, with over 60,000 GitHub stars and millions of downloads. The campaign uses typosquatted domains that closely mimic the legitimate tesseract-ocr.github.io documentation site and official download pages.
**Attack Chain Overview**: Victims searching for Tesseract OCR downloads, documentation, or Windows installers are redirected to convincing typosquatted sites. These sites present a ClickFix-style interaction — a fake error dialog, CAPTCHA verification, or "system check" that instructs the user to open the Windows Run dialog (Win+R) and paste a command that has been silently copied to their clipboard. The clipboard payload is a PowerShell one-liner that initiates a multi-stage malware delivery chain.
**ClickFix Social Engineering Evolution**: This campaign represents an evolution of the ClickFix technique (first documented in 2024), which has rapidly become one of the most prevalent social engineering methods. Unlike earlier ClickFix campaigns that used generic "browser update" or "verification" pretexts, this variant specifically targets the developer community by impersonating a legitimate open-source tool. The ClickFix approach bypasses traditional email-based phishing defenses because the victim voluntarily executes the payload — no exploit, no attachment, no macro.
**Multi-Stage Payload Delivery**:
- **Stage 1 (Clipboard + Run Dialog)**: PowerShell one-liner copied to clipboard via JavaScript. Uses window.navigator.clipboard.writeText() or document.execCommand('copy') to silently stage the payload. The command uses -ExecutionPolicy Bypass -WindowStyle Hidden to execute silently.
- **Stage 2 (Downloader)**: The initial PowerShell downloads an obfuscated script from attacker infrastructure. The script uses Base64 encoding layered with XOR obfuscation and string concatenation to evade static detection.
- **Stage 3 (Environment Check)**: Before deploying the final payload, the malware performs environment fingerprinting — checking for virtual machines (VMware, VirtualBox, Hyper-V via WMI queries), sandbox environments (checking for common analysis tools like Wireshark, Process Monitor, IDA Pro), and security products. It also checks the number of running processes, installed software count, and system uptime to detect automated analysis.
- **Stage 4 (Defense Evasion)**: The malware implements AMSI bypass (patching AmsiScanBuffer in amsi.dll), ETW patching (disabling Event Tracing for Windows to blind EDR), and Windows Defender exclusion path addition via PowerShell (Add-MpPreference -ExclusionPath).
- **Stage 5 (Final Payload)**: Deploys an information stealer targeting browser credentials, cryptocurrency wallets, SSH keys, and developer tokens (GitHub, GitLab, npm, PyPI API tokens). Also establishes persistence via scheduled tasks and startup folder shortcuts.
**Typosquatting Domains**: The campaign registers domains that closely resemble legitimate Tesseract OCR infrastructure:
- tesseract-ocr[.]org (vs. legitimate tesseract-ocr.github.io)
- tesseractocr[.]download
- tesseract-download[.]com
- tesseract-ocr-installer[.]com
- ocr-tesseract[.]com
These domains use valid HTTPS certificates (Let's Encrypt), professional-looking landing pages cloned from the real site, and SEO poisoning to appear in search results.
**Developer-Specific Targeting**: Unlike generic ClickFix campaigns, this variant specifically targets the developer ecosystem. Tesseract OCR is used extensively in document processing pipelines, data extraction workflows, and CI/CD systems. Compromising developer machines provides access to source code repositories, cloud credentials, API tokens, and CI/CD pipeline secrets.
**Obfuscation Techniques**: The PowerShell payloads use multiple layers of obfuscation: (1) Base64 encoding with -Enco
Weaknesses (CWE)
CWE-451, CWE-494, CWE-693
Target sectors: technology, software-development, research, education, financial
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 16 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1566.002, T1189, T1059.001, T1204.001, T1204.002, T1053.005, T1547.001, T1027, T1027.010, T1140