ClickFix - Fileless NetSupport Delivery (T1105)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•1

Correlates the ClickFix execution directly to the creation of the NetSupport RAT files (client32.exe) in public directories, specifically when PowerShell is used to access the clipboard.