ClickFix-style Lure Spawns Encoded PowerShell or Piped zsh from Browser

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•1

Detects instances where common web browsers (Chrome, Edge, Firefox, Safari) or related desktop applications spawn shell interpreters (PowerShell on Windows, bash/zsh/sh on macOS) with command-line arguments indicative of malicious activity, such as base64-encoded payloads, hidden windows, or remote script downloading.