Telegram captcha tricks you into running malicious PowerShell scripts

Threat actors exploited news about Ross Ulbricht to promote malicious Telegram channels that present a fake 'Safeguard' verification; a Telegram mini app copies a PowerShell command to victims' clipboards and instructs them to paste and run it, which downloads a ZIP (from http://openline.cyou) containing files including identity-helper.exe — a suspected Cobalt Strike loader — enabling remote access and potential follow-on ransomware or data theft.