ClickFix Clipboard Hijack: mshta URL fetch or hidden PowerShell via Run Dialog

Georgios Maragos@Gmarak

•updated Jul 7, 2026•15•0•43

Detects potential execution of malicious HTA files or encoded PowerShell commands initiated from the Windows Explorer Run dialog. This behavior is consistent with 'ClickFix' social engineering attacks where users are tricked into copying and pasting commands into the Run dialog to bypass security controls under the guise of verifying a fake CAPTCHA.