ClickFix Paste-and-Run via RunMRU Registry Write (powershell/curl/base64)

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•8

Detects modifications to the Windows RunMRU registry key where the value contains suspicious strings such as 'powershell', 'curl', or long encoded strings. This behavior is indicative of potential command execution, persistence, or staging via the RunMRU list.