Phishing Series 2026: Post-ClickFix AMSI/ETW Bypass PowerShell Chain

Ibrahim Saud@tektrix

•updated Sep 25, 2026•0•0•2

Detects the use of PowerShell script blocks that attempt to bypass or disable Antimalware Scan Interface (AMSI) or Event Tracing for Windows (ETW) by interacting with internal .NET objects or DLLs, a common technique in phishing-delivered payloads.