ClickFix Lure — Download Tool Execution via explorer.exe Run Dialog

Duo Tech@duotech

•updated Jun 30, 2026•1•0•1

Detects instances where explorer.exe spawns command-line utilities (cmd.exe, powershell.exe, mshta.exe) with command-line arguments indicative of file downloading or remote execution (e.g., curl, certutil, bitsadmin, Invoke-WebRequest). This pattern is often associated with ClickFix social engineering attacks, where a victim is tricked into pasting malicious commands directly into the Windows Run dialog.