ClickFix clipboard-hijack PowerShell execution via Win+R from explorer.exe

Ibrahim Saud@tektrix

•updated Jul 3, 2026•4•0•7

Detects instances where PowerShell is executed via the Windows Run dialog (explorer.exe), utilizing common download-cradle patterns (IEX/Invoke-Expression and Invoke-RestMethod) typically associated with ClickFix clipboard-hijacking social engineering campaigns.