ClickFix PowerShell Clipboard Access via Explorer

nomit vyas@xoxo

•updated Jun 25, 2026•2•0•8

Detects the execution of PowerShell from explorer.exe (the Windows Shell) involving commands that access the clipboard, which is a common indicator of the ClickFix social engineering attack technique. In this scenario, users are deceived into copying and pasting malicious commands into the Run dialog.