ClickFix: PowerShell/mshta Launched from explorer.exe via Clipboard Paste-and-Run

Ibrahim Saud@tektrix

•updated Jul 3, 2026•9•0•9

Detects instances where Windows Explorer (explorer.exe) spawns common command-line interpreters (powershell.exe, mshta.exe, cmd.exe) with suspicious command-line arguments indicative of fileless execution, obfuscation, or remote payload retrieval.