KongTuke ClickFix - PowerShell spawned from explorer.exe via Windows Run dialog

Ibrahim Saud@tektrix

•updated Jun 24, 2026•1•0•5

Detects potential 'ClickFix' social engineering attacks where users are lured into manually executing malicious PowerShell or CMD commands via the Windows Run dialog following a browser crash, or using finger.exe as a LOLBIN to download payloads.