nordertextil.de: a ClickFix loader site for Windows, and what to do if you pasted its PowerShell command

What nordertextil.de is, and what we know about it

We know nordertextil.de only through four malware addresses that a URLhaus reporter added on 25 September 2026. We never saw the page that visitors see, so this guide says plainly which parts are reports and which parts are our own checks.

1. 1

   What URLhaus lists

   Four addresses on nordertextil.de, all added on 25 September 2026 at about 06:23 UTC by the reporter RoKoBo: /room, /t/pcmd2, /enter and /t/dokument281. Each carries the same five tags, ClickFix, DEU, exe, Loader and powershell. All four are marked malware_download and all four were offline when we read them.

2. 2

   What the tags mean

   ClickFix is a trick in which a fake page makes you copy a command and run it yourself. powershell is the Windows scripting tool that such a command starts. exe says a Windows program is involved, and Loader says the program's job is to bring in further malware. DEU is a country label, and we do not know exactly what the reporter meant by it.

3. 3

   What we could not confirm

   We did not download any file and we never saw the page that tells visitors what to paste. So we do not know the lure, which loader family it is, or what it installs next. The labels are the reporter's, not our own findings.

4. 4

   What this means for you

   If you only saw the name in a log, a link or a warning, that alone did not infect you. The risk is for people who pasted a command from the site into Run, Windows Terminal or PowerShell, or who opened a file from it.

Kind of threat

A malware download address for Windows PCs, tagged ClickFix and Loader

Delivery trick

ClickFix: a fake page asks you to copy a command and paste it into Run or PowerShell

Domain registration

Not known to us. The registry for .de domains has no RDAP service in our lookup, so we have no creation date or registrar

URLhaus entries

4 file addresses, all added on 25 September 2026, all offline when we read them

Platform

Windows, by the powershell and exe tags

What we checked on 10 October 2026, and what we could not

We tried to open https://nordertextil.de/ once, from Lithuania, in an automated Chromium browser set to English. The browser could not find the domain. That tells you nothing good about the site, and it clears nothing.

What happened to nordertextil.de, from the first report to our test

The public record is short. We have no registration data, so the history starts with the first report. The dates come from the URLhaus database and from our own test.

1. 25 September 2026

   Four files are reported in three seconds

   At about 06:23 UTC the reporter RoKoBo adds four addresses to URLhaus: /t/dokument281 first, then /room, /t/pcmd2 and /enter two seconds later. This is the first time URLhaus sees the host in our copy of the data.

2. 10 October 2026

   Our test finds no address for the name

   Our single visit fails with a name resolution error. When we read the database all four addresses are marked offline.

Fifteen days passed between the reports and our test. A domain that stopped answering in that window may have been cleaned up, or switched off by whoever runs it. A name that no longer answers does not remove the risk for a PC that already ran the command.

A German name that sounds like a textile business can be an operator's own domain or a real small firm whose website was hacked and used to host the files. We found no page for a business of this name, and we do not say which case this is. If you own the domain, see the answer in the FAQ.

How the ClickFix trick works on Windows

ClickFix does not use a security hole. It makes you do the infecting yourself, so the warnings of your browser and your antivirus often never get a say. We did not see nordertextil.de's page; this is how Microsoft describes the trick.

1. 1

   You land on a page with a check

   Microsoft says victims reach a fake CAPTCHA, a human verification or an error page through phishing email, malicious ads or compromised sites. The lures often copy Cloudflare Turnstile, Google reCAPTCHA or Discord.

2. 2

   The page copies a command for you

   Clicking the button silently puts a command on your clipboard through the browser. The page then tells you to paste it into the Run box, Windows Terminal or PowerShell.

3. 3

   You open Run and paste

   The steps ask you to press the Windows key + R, press Ctrl + V and press Enter. Microsoft says attackers like the Run box because many users do not know what it does.

4. 4

   A loader is fetched and run

   The command usually starts PowerShell, mshta or curl and downloads a first stage. The tags Loader, exe and powershell on these addresses fit that pattern, but we did not see what this loader does.

5. 5

   Nothing seems to happen

   A window that flashes and closes, or a CAPTCHA that never finishes, is the whole experience for many victims. Microsoft says payloads are often loaded into memory through built in tools such as powershell.exe, msbuild.exe and regasm.exe.

Because a person starts the command, many automated defences treat it as normal. Microsoft notes that successful Run commands are recorded in the registry key RunMRU, which is why that key matters later in this guide.

The four addresses: what each suggests, and what we do not know

Paths and tags are weak evidence. We list what each address could be and mark which statements are only a reading of the name.

All four carry the same tags and were added within about two seconds. That suggests one reporter looked at one chain. It does not tell us how many people received it, and URLhaus shows no victim count.

What a ClickFix loader on Windows can bring in

We do not know what the loader on this server installs. Here is what Microsoft and Arctic Wolf publish about ClickFix chains of the same kind, as a guide to what may be at stake.

What this can cost you

Reading the site name or seeing a warning costs nothing. The risks below apply to a PC where the command was pasted and run, or a file from the site was opened.

• High

  Account takeover

  If the loader brought in a stealer, saved logins and browser sessions can be used to enter your email, social and work accounts. Changing a password alone may not end a stolen session.

• High

  Crypto theft

  Wallet files and wallet apps are a main target of the stealers that ClickFix delivers. Stolen crypto cannot be reversed, so move funds from a clean device first.

• High

  Someone else controlling the PC

  Microsoft lists remote access tools among the payloads. With one of them running, a person can use the PC, see the screen and read files.

• Medium

  A hidden program that starts again

  Some chains add a scheduled task, a Startup entry or a registry Run key. Until it is gone the PC keeps contacting the attackers.

• Medium

  Work accounts and company data

  On a work PC the passwords and sessions in the browser reach company systems. Tell your IT or security team at once; they can block the accounts.

• Low

  Nothing, if you only saw the name

  A name in a warning, a firewall log or a blocked link is not an infection.

What you may notice, and what you may not

Many victims notice nothing. The signs below follow from how these chains work; the first two are the best evidence you have.

How people end up on a page like this

We do not know how visitors reached nordertextil.de. These are the routes that Microsoft names for ClickFix pages in general.

1. 1

   A phishing email with a link

   An email about a document, an invoice or an order sends you to a page that must be checked before you can read it. The path /t/dokument281 fits that picture, but this is only our reading.

2. 2

   A malicious ad

   Microsoft lists malvertising as a route. An ad on a search page sends you to a fake check.

3. 3

   A hacked website

   Microsoft lists compromised sites. A real small business site can show a fake CAPTCHA after criminals change its pages, and the owner may not know.

4. 4

   A fake Windows or browser fix

   A page claims that your browser is broken or a font is missing and offers a fix that you paste into Run.

Check your Windows PC before you delete anything

Start with the question that matters: did you paste a command from a website into Run, Windows Terminal or PowerShell, or open a file from nordertextil.de? If yes, follow the numbered plan on this page, because a clean looking check does not clear a PC. If you are not sure, do these checks first. None of them deletes anything.

While you check, stop using the PC for banking, email, work or crypto, and disconnect it from Wi-Fi and network cables if you can.

1. 1

   Read the Run box history

   Open Registry Editor (press the Windows key, type regedit, press Enter) and go to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU. Each value is a line typed into Run. Look at it, do not run it, and do not delete it yet. Write down or photograph any line with powershell, iex, irm, mshta, curl or a web address.

2. 2

   Look for a scheduled task you did not make

   Press the Windows key, type Task Scheduler and open it. Select Task Scheduler Library and read the names and the Actions tab of any task that is new or has a random name. Do not delete anything yet; note the name.

3. 3

   Look in the Startup folder

   Press Windows key + R, type shell:startup and press Enter. A file that you did not put there is worth noting.

4. 4

   Check Windows Security

   Open Windows Security, choose Virus & threat protection, then Protection history. On Windows 10 the app is under Settings, Update & Security, Windows Security. Look for detections dated around the time you pasted the command.

5. 5

   Remember what a clean check means

   Clearing RunMRU removes evidence of the command, not the malware. In memory payloads may leave nothing in these places. A clean check lowers the doubt; it does not remove it.

Scan from outside Windows: Microsoft Defender Offline

An offline scan runs before the normal Windows starts, so a hidden program cannot hide from it as easily. Microsoft's page says it targets malware that tries to bypass the Windows shell, such as rootkits.

1. 1

   Prepare

   Save your work and close programs. Microsoft says the scan takes about 15 minutes and restarts the PC. You must be signed in as a local administrator, and the Windows Recovery Environment must be enabled. To check, open a Command Prompt as administrator and run reagentc /info; if it says Disabled, run reagentc /enable. Microsoft says that with it disabled the scan does not run and shows no error.

2. 2

   Suspend BitLocker if it is on

   If BitLocker protects the system drive, suspend it first. Otherwise the PC may ask for your recovery key when it restarts into the offline scan.

3. 3

   Start the scan

   Open Windows Security, choose Virus & threat protection, then Scan options. Select Microsoft Defender Offline scan and then Scan now. Accept the prompts. The PC signs you out, restarts into the scan and starts Windows again when it ends.

4. 4

   Read the result

   Open Windows Security, then Virus & threat protection, then Protection history. Microsoft says the scan does not apply to ARM versions of Windows, and that Microsoft Defender Antivirus must be the main antivirus to receive its updates.

5. 5

   Do not stop there

   A scan that finds nothing does not prove the PC is clean if a remote access tool was running. If you pasted a command and it ran, the safest end of the plan is to back up documents and reinstall Windows.

If you use a Mac, an iPhone or an Android phone

The powershell and exe tags point at Windows. We found nothing that says the four addresses work on anything else.