ClickFix Fake CAPTCHA/Update Lure Triggering PowerShell via Paste

Ibrahim Saud@tektrix

•updated Sep 18, 2026•3•0•4

Detects instances where PowerShell or mshta.exe are launched by a web browser or Windows Explorer, often indicative of the 'ClickFix' social-engineering campaign. In this scenario, users are tricked into copying and pasting malicious commands from a fake CAPTCHA or update prompt directly into a Windows terminal or the Run dialog, leading to code execution.