IClickFix PowerShell Download and Execution

Elgonad .@elgonad

•updated Jan 29, 2026•2•0•51

Detects the execution of a hidden PowerShell window that uses Invoke-WebRequest to download and then execute a second-stage PowerShell script. This behavior is characteristic of the IClickFix framework's "ClickFix" social engineering tactic used to deliver malware like NetSupport RAT.