Phishing Series 2026: ClickFix Fake CAPTCHA Clipboard-to-Run-Dialog Execution

Ibrahim Saud@tektrix

•updated Sep 25, 2026•0•0•4

This rule detects the 'ClickFix' social engineering technique where a user is manipulated into manually invoking the Windows Run dialog (Win+R) and pasting a malicious command. The rule monitors for instances where explorer.exe spawns command interpreters like cmd.exe, powershell.exe, or mshta.exe with suspicious command-line patterns indicative of encoded payloads, script execution, or remote downloads.