ClickFix: Run dialog spawns mshta/PowerShell fetching remote payload

Ankit Mehta@Secvyn

•updated Sep 20, 2026•0•0•2

Detects execution chains where explorer.exe (acting as the Run dialog host) spawns suspicious processes like mshta.exe, powershell.exe, or cmd.exe with command lines containing URL indicators (http), common payload filenames (rtdx.dat), or specific IP address strings associated with known ClickFix social-engineering campaigns.