ClickFix Win+R: explorer.exe spawns PowerShell/mshta with clipboard-injected ClickFix command

Ibrahim Saud@tektrix

•updated Jul 3, 2026•48•0•57

Detects ClickFix-style social engineering attacks where users are coerced into pasting and executing malicious commands (PowerShell/mshta) via the Windows Run dialog (explorer.exe), or instances where PowerShell processes spawned from the Run dialog perform network communication over suspicious ports commonly associated with this campaign.