Phishing Series 2026: ClickFix Fake CAPTCHA Lure Spawns Script Interpreter with Download Cradle

Ibrahim Saud@tektrix

•updated Sep 25, 2026•0•0•2

Detects the 'ClickFix' social engineering attack where a user is instructed to use the Windows Run dialog (Win+R) to execute a malicious one-liner. This activity is characterized by explorer.exe spawning common command/script interpreters (powershell, cmd, mshta, etc.) containing typical download-and-execute strings (cradles), which bypasses browser-based download security controls.