ClickFix Browser-Spawned Shell Download Cradle and RAT Execution

Ibrahim Saud@tektrix

•updated Jun 30, 2026•7•0•10

Detects the ClickFix kill chain where a web browser process (e.g., Chrome, Edge, Firefox) spawns a command shell or utility (cmd.exe, powershell.exe, mshta.exe) to execute a download cradle or deploy known payloads like NetSupport RAT. This behavior is typically associated with malicious CAPTCHA prompts that deceive users into pasting and executing commands via the Windows Run dialog.