ClickFix CAPTCHA Lure: Browser/Shell Spawning Terminal Processes

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•3

Detects the execution of command-line interfaces (cmd.exe, powershell.exe, wscript.exe, mshta.exe) when spawned by common browser processes or Windows Explorer. This is a common pattern for drive-by downloads or malicious scripts executed via the browser, characterized by command lines containing download indicators (e.g., Invoke-Expression, curl, certutil, encoded commands).