ClickFix: StealC ClickFix Persistence via WScript.Shell LNK in Startup Folder

Arnold Chan@slaz

•updated Sep 18, 2026•2•0•2

Detects the creation or execution of script files (.lnk) within the Windows Startup folder initiated by script hosts (wscript.exe or cscript.exe) that contain suspicious command-line arguments indicative of malicious activity, such as PowerShell obfuscation or encoded commands.