ClearFake SyncAppvPublishingServer ClickFix Campaign

Lacey Cochrane@NullVectorX

•updated Jan 25, 2026•10•1•151

Detects the execution of SyncAppvPublishingServer.vbs with a command line containing a semicolon, which is indicative of the ClearFake malware campaign's ClickFix technique. This technique abuses SyncAppvPublishingServer.vbs to proxy execution of malicious PowerShell commands, often delivered via social engineering involving malicious copy-paste actions.