ClickFix Run-dialog execution of short base64-encoded PowerShell from explorer.exe

Ethan Andrews@eandrews

•updated Jul 24, 2026•20•0•34

Detects the ClickFix technique where a fake 'Webcam Compatibility' / 'Zoom SDK Update' lure instructs a victim to press Win+R, paste clipboard content into the Run dialog, and press Enter, resulting in explorer.exe spawning powershell.exe with a short base64-encoded one-liner (<600 bytes)