ClickFix: explorer.exe spawns obfuscated PowerShell via Run dialog

Ibrahim Saud@tektrix

•updated Sep 18, 2026•1•0•1

Detects instances where explorer.exe spawns cmd.exe or powershell.exe with command-line arguments indicative of obfuscated execution, such as encoded commands, hidden window styles, or bypass flags. This pattern is consistent with ClickFix social engineering attacks where users are deceived into manually executing malicious commands via the Windows Run dialog.