ClickFix - Clipboard Hijack via Explorer to PowerShell (T1059.001)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•2

Identifies the core ClickFix vector: explorer.exe (via the Windows Run prompt) executing pasted PowerShell commands containing IEX and Get-Clipboard to execute the first stage.