ClickFix - Clipboard Hijack to PowerShell (T1059.001)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•8•0•12

Detects the initial ClickFix mechanism where a user is socially engineered into pasting a malicious script (Get-Clipboard) into the Run dialog (explorer.exe), which launches PowerShell to fetch the CastleLoader.