Hidden PowerShell Console via ShowWindowAsync GUID Title (ClickFix Loader)

Ibrahim Saud@tektrix

•updated 21 days ago•0•0•0

Detects PowerShell command lines that attempt to hide the console window by calling ShowWindowAsync from user32.dll while assigning a randomly generated GUID as the window title. This technique is used to evade detection by keeping malicious PowerShell activity invisible to the user, as seen in recent StealC infostealer loader chains.