ClickFix Fake Webcam/Zoom SDK Modal Triggers Shell via Run Dialog Paste
Detects a PowerShell or command shell process spawned directly by explorer.exe, consistent with a victim using the Win+R Run dialog to paste and execute a clipboard-borne command as instructed by a fake 'Webcam Compatibility'/'SECURITY WARNING'/'Zoom SDK Update' ClickFix modal. Tightened to reduce false positives from routine admin Run-dialog usage by excluding shell invocations that reference a saved script file (-File, .ps1/.bat/.vbs) or common IT support script/deployment paths, since a genuine ClickFix paste-execute is an inline one-off command typed/pasted directly into the Run box rather than a call to a maintained script. Analysts should additionally corroborate with a short-lived explorer.exe parent session (Run dialog opened immediately before the child process spawn) where session telemetry is available.
Sigma
