ClickFix-style PowerShell launched from Explorer via Run dialog

Duo Tech@duotech

•updated Aug 20, 2026•26•0•46

Detects instances of PowerShell being launched directly by explorer.exe with command-line arguments indicative of malicious activity, specifically the 'ClickFix' pattern where users are social-engineered to copy/paste malicious commands into the Windows Run dialog.