ClickFix - Hidden PowerShell Download Cradle via Run Dialog

Georg Lauenstein@gsec

•updated 6 days ago•6•0•6

Detects PowerShell being launched directly from the Windows Run dialog (explorer.exe parent) with a hidden window and a download/execution cradle in the command line. This is the core artifact of ClickFix campaigns, where the victim is lured to an Amazon-themed decoy page, copies a pasted command, and executes it from Run to retrieve and run the next-stage malware.