Phishing Series 2026: ClickFix mshta.exe or rundll32.exe Execution via Fake Verification Prompt

Ibrahim Saud@tektrix

•updated Sep 25, 2026•0•0•2

Detects mshta.exe or rundll32.exe spawned as a direct child of explorer.exe with a remote HTTP/HTTPS URL or javascript: URI as an argument. This pattern is indicative of ClickFix-style phishing campaigns where users are socially engineered into running malicious commands via the Windows Run dialog or clipboard, leading to execution of remote malicious payloads proxied through trusted system binaries.