ClickFix-style clipboard-pasted batch/PowerShell execution via Explorer Run dialog

Duo Tech@duotech

•updated Aug 5, 2026•12•1•18

Detects the ClickFix-style social engineering technique used in the UNC6692 campaign where a victim, prompted via fake 'Outlook Version Verification' / 'OS Version Verification' buttons on a phishing page, is coerced into pasting a clipboard-copied batch or PowerShell script into the Windows Run dialog for execution.