Suspicious Conhost Headless Execution

Duo Tech@duotech

•updated Jun 9, 2026•2•0•6

Detects the execution of conhost.exe (or conhost.ext) with the --headless parameter, a technique used in ClickFix campaigns to silently execute clipboard-injected commands.