ClickFix Series: Win+R Run-Dialog RunMRU Followed by Suspicious Shell Execution

Ibrahim Saud@tektrix

•updated Sep 28, 2026•0•0•6

Detects instances where the Windows Explorer process (the parent of the 'Run' dialog) spawns common command-line interpreters. This behavior is indicative of the 'ClickFix' phishing technique, where users are socially engineered to paste malicious commands into the Windows Run dialog.