ClickFix Lure: Explorer-Spawned mshta/PowerShell via Run Dialog

Arnold Chan@slaz

•updated Sep 7, 2026•0•0•1

Detects suspicious execution of PowerShell or Mshta spawned from Explorer.exe. It looks for specific malicious indicators including references to known malicious domains, PowerShell encoding flags, hidden window arguments, or Mshta HTTP requests, which are common patterns for fileless malware or dropper execution.