Terminal Spawning PowerShell ClickFix

Kaung Khant Ko@kaungkhantko

•updated Jun 17, 2026•14•0•94

Detects Windows Terminal (wt.exe) spawning PowerShell with specific command-line arguments, typically indicative of user-pasted malicious commands from ClickFix fake update lures linked to Rapid Brigantine.