Suspected ClickFix commands in RunMRU registry key value

Salten Fisk@saltenfisk

•updated Jul 9, 2025•15•6•168

In a ClickFix exploit, a command is silently copied to the clipboard when visiting a compromised web page. The user then pastes it into Windows Run believing it's a captcha or a system fix. The executed command is added to the RunMRU registry key which holds details of Windows Run Most Recently Used. This hunt is intended to identify ClickFix exploits by searching the RunMRU registry key value.