ClickFix Fake CAPTCHA Browser Spawning PowerShell or Terminal Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•4•0•6

Detects instances of common web browser processes (Chrome, Firefox, Edge, etc.) spawning command-line interpreters or scripting hosts (PowerShell, cmd.exe, mshta.exe, wscript.exe, cscript.exe). This pattern is consistent with ClickFix social engineering attacks, where users are manipulated into copying and executing malicious commands from a fake CAPTCHA or error prompt.