ClickFix PowerShell or Script Execution Spawned from Browser Process

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•5

Detects ClickFix social engineering attacks where a web browser process spawns a scripting interpreter (powershell.exe, mshta.exe, or wscript.exe) or where a command shell executes PowerShell with encoded arguments, typically indicating a user has been tricked into executing malicious code.