ClickFix Fake-Update Social Engineering: Correlated Fake-Dialog Keyword + Base64 Shell from Browser-Spawned Explorer Chain

Duo Tech@duotech

•updated Aug 5, 2026•0•0•6

Detects a browser-spawned explorer.exe chain launching powershell.exe, cmd.exe, mshta.exe, or rundll32.exe with both base64/obfuscation indicators and fake-update/support-dialog keywords in the command line, consistent with ClickFix-style social engineering.