Fileless PowerShell Spawned by mshta.exe in ClickFix Chain

Arnold Chan@slaz

•updated Sep 5, 2026•0•0•0

Detects the execution of PowerShell with suspicious command-line arguments (e.g., encoded commands, hidden windows) initiated by mshta.exe, excluding instances where a .ps1 script file is involved. This pattern often indicates attempts to bypass execution policy or run obfuscated payloads in memory, which is a common behavior of malicious HTA files.