ClickFix - Clipboard Access via PowerShell

nomit vyas@xoxo

•updated Jun 25, 2026•3•0•21

Detects ClickFix attack patterns where users are coerced into pasting malicious PowerShell commands into the Windows Run dialog (explorer.exe). The command uses clipboard access (Get-Clipboard) or network download/execution (iwr, iex) methods, commonly associated with the Potemkin Loader or RMM-based distribution campaigns.