ClickFix: explorer.exe spawns obfuscated PowerShell via Run dialog

Ibrahim Saud@tektrix

•updated Sep 18, 2026•2•0•4

Detects instances where Windows Explorer (explorer.exe) spawns PowerShell with heavily obfuscated command lines, characterized by caret-obfuscation and execution policy bypass flags. This pattern is characteristic of ClickFix social engineering, where a user is tricked into pasting malicious commands into the Windows Run dialog.