Suspicious Command In RunMRU via ClickFix Technique

Robert Fly@robertfly

•updated Jul 22, 2025•1•0•59

Detects suspicious commands written to the RunMRU registry key. This is a characteristic of the "ClickFix" social engineering technique, where a user is tricked into copying a malicious command and executing it via the Windows Run dialog (Win+R). This technique is notably used by Lumma Stealer affiliates.