ClickFix Script Execution via Run Dialog or Browser-Initiated Parent Process

Ibrahim Saud@tektrix

•updated Jun 24, 2026•1•0•6

Detects suspicious process creations (PowerShell, Cmd, Mshta, Wscript) originating from web browsers, explorer.exe (likely from the Run dialog), or rundll32.exe. This pattern is often associated with social engineering attacks like 'ClickFix' where users are tricked into pasting malicious commands.