Suspicious Conhost Headless Execution

Duo Tech@duotech

•updated Jun 9, 2026•0•0•3

Detects the execution of conhost.exe with the --headless parameter. This technique is actively used in ClickFix campaigns to silently execute clipboard-injected commands in the background without user awareness.