ClickFix clipboard-paste PowerShell/mshta execution via Run dialog

Ibrahim Saud@tektrix

•updated 21 days ago•0•0•1

Detects instances where Windows Explorer (explorer.exe) launches common script interpreters like PowerShell or mshta, often indicative of a 'ClickFix' social engineering attack where a user is coerced into pasting malicious commands into the Windows Run dialog.