ClickFix Chain: Explorer-Spawned PowerShell Injects via Anti-Debug Evasion

Arnold Chan@slaz

•updated Sep 18, 2026•0•0•2

Detects a suspicious PowerShell process lineage spawned by explorer.exe that exhibits characteristics of a 'ClickFix' social engineering lure (using obfuscated command lines) and proceeds to inject code into legitimate Windows or browser processes such as csc.exe, chrome.exe, msedge.exe, or SearchIndexer.exe. This activity is often associated with malware attempting to evade debugging.