ClickFix: explorer.exe spawns obfuscated PowerShell via Run dialog

Ibrahim Saud@tektrix

•updated Sep 18, 2026•1•0•2

Detects the execution of PowerShell with suspicious command-line arguments (obfuscation, hidden windows, or encoded commands) directly spawned from explorer.exe. This activity is frequently associated with malicious scripts or payloads executing in the context of user activities to evade detection.