ClickFix: PowerShell/cmd/mshta/RunDLL32 Spawned by Browser Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•6•0•5

Detects instances where common browser processes (e.g., Chrome, Edge, Firefox) spawn command-line tools or scripting interpreters such as PowerShell, cmd, mshta, or rundll32. This pattern is characteristic of 'ClickFix' social engineering attacks where users are tricked into executing malicious commands under the guise of troubleshooting or CAPTCHA resolution.