Electron Login Persistence And Remote Execution Via Clickfix

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•0•0•9

Detects Electron applications attempting to establish persistence using `setLoginItemSettings` in conjunction with JavaScript code execution (`eval`) or external process execution (`child_process` and `execFile`). This combination is indicative of malicious activity, such as that observed in Clickfix attacks, where an application gains persistence and then executes arbitrary code.