Phishing Series 2026: ClickFix-Style Command Execution Spawned from Browser or Explorer

Ibrahim Saud@tektrix

•updated Sep 25, 2026•0•0•2

This rule detects potential 'ClickFix' phishing activity where a user is tricked into executing malicious commands in a Windows shell. The rule looks for browser or file explorer processes acting as the parent process to command-line interpreters (cmd.exe, powershell.exe, etc.) executing suspicious command-line arguments often used to fetch or run malicious scripts from the internet.