ClickFix Attacks Mature: Shortcut Abuse, Portable Python Payloads, and Infrastructure Hijacking

ClickFix has grown from a crude clipboard trick into a platform-agnostic delivery framework that treats the human operator as its execution engine. The technique instructs victims to paste attacker-supplied commands into system utilities. It now spans Windows and macOS kill chains [2]. On Windows alone, the method has splintered into multiple variants: browser denial-of-service coercion via malicious extensions ("CrashFix") [4], portable Python environment bundling, and abuse of native utilities for post-execution reconnaissance. Attackers have also moved upstream, compromising over 700 legitimate websites running Ghost CMS to inject fake CAPTCHA overlays directly into trusted pages [1].

The core mechanic has not changed. A fake error, CAPTCHA, or verification prompt tells the user to open a system utility and paste a command. JavaScript on the page silently loads that command to the clipboard. The user executes it voluntarily, and most endpoint controls never fire because no malicious file touches disk and the process tree looks legitimate. What has changed is everything around that core: the lures are more sophisticated, the infrastructure is hijacked rather than built from scratch, and the payloads may include full portable runtime environments that can guarantee execution regardless of local system configuration [1].

Background: From Commodity Trick to State-Sponsored Tool

Proofpoint publicly documented ClickFix on June 17, 2024, tracking campaigns from TA571 as early as 1 March 2024 and ClearFake operations that used fake browser update pages and error overlays to coerce users into running PowerShell commands [2]. By April 2025, Proofpoint reported that state-sponsored actors from North Korea (TA427), Iran (TA450), and Russia (UNK_RemoteRogue, TA422) had all experimented with the technique between October 2024 and early 2025 [3]. TA427 returned to ClickFix with a slightly varied infection chain in April 2025, over two months after initial sightings in January-February 2025, though Proofpoint noted no actor had shown sustained repeated use in the weeks immediately following their initial campaigns [3].

The technique's appeal to both criminal and state-sponsored operators comes down to a structural gap. Browser sandboxes do not inspect clipboard contents. UAC prompts often do not fire because the user is manually opening a trusted system utility. Security awareness training still focuses on malicious links and attachments, not on commands users paste into their own terminal. ClickFix sits in a gap between what security tools monitor and what users are trained to suspect.

Infrastructure Hijacking: Ghost CMS and CVE-2026-26980

One of the most significant recent developments is the shift from attacker-controlled infrastructure to hijacked legitimate sites. Beginning May 7, 2026, QiAnXin XLab researchers detected a large-scale campaign that compromised more than 700 websites running Ghost CMS by exploiting CVE-2026-26980, an unauthenticated SQL injection vulnerability (CVSS 9.4) in Ghost's Content API slug filter ordering, affecting versions 3.24.0 through 6.19.0 [1]. Attackers used the vulnerability to steal Admin API keys, then injected fake Cloudflare and CAPTCHA verification steps directly into article pages of trusted, legitimate domains [1]. At least two distinct threat clusters were identified operating concurrently, sometimes re-infecting the same domains after cleanup [1].

This matters because domain reputation filters and URL blocklists become far less effective when the malicious content lives on a site your users already trust. The injected overlays were visually consistent with legitimate Cloudflare challenges, making them nearly impossible for end users to distinguish from the real thing.

Windows Execution Entry Points: Beyond Win+R

The standard ClickFix flow on Windows instructs the victim to press Win+R to open the Run dialog, then paste and execute a PowerShell or mshta command. This produces a well-known process lineage: explorer.exe spawning powershell.exe or cmd.exe via the Run dialog. Most detection engineering for ClickFix focuses on this exact parent-child relationship. But the Run dialog is only one of several paste-and-run surfaces Windows exposes, and attackers are aware that defenders have built detections around it. The sections below cover each additional entry point, the OS behavior that makes it viable, and the detection angles defenders should consider.

Win+R: The Standard Run Dialog

The baseline ClickFix attack instructs the user to press Win+R, paste a command from the clipboard, and hit Enter. This opens the Windows Run dialog, a single-line text input that accepts commands, paths, and URIs. The resulting process tree is explorer.exe spawning the target process (e.g., powershell.exe, cmd.exe, mshta.exe). This lineage is the most commonly detected ClickFix indicator because it is distinctive: legitimate user behavior rarely involves explorer.exe spawning powershell.exe -e <base64> via the Run dialog. EDR products with process-tree telemetry can flag this pattern reliably.

Win+X: The Power User (WinX) Menu

Pressing Win+X opens the Power User menu (also called the WinX menu), which provides direct shortcuts to Terminal, PowerShell, PowerShell (Admin), Command Prompt, Task Manager, and the Run dialog itself. On Windows 10 and 11, this menu is a built-in administrative convenience feature. A ClickFix lure that tells users to press Win+X and then select "Terminal" or "PowerShell (Admin)" achieves two things the basic Win+R path does not. First, it can land the attacker directly in an elevated (Administrator) session without triggering a separate UAC prompt, because the user is explicitly choosing the "(Admin)" option and approving the UAC consent dialog as part of what they believe is a troubleshooting step. Second, the resulting process lineage may differ from the standard explorer.exe to powershell.exe chain, depending on the Windows version and configuration. Defenders should test in their own environments to establish baseline parent-child relationships for WinX-launched processes. Detections tuned exclusively for the explorer.exe to powershell.exe chain may miss this path.

Detection angle: Monitor for powershell.exe or WindowsTerminal.exe with suspicious command-line arguments, particularly encoded commands (-e, -enc, -EncodedCommand) or download cradles (IEX, Invoke-WebRequest, Start-BitsTransfer), regardless of parent process. Log and alert on any Win+X menu launch of an administrative shell that immediately executes clipboard content.

Win+S / Win+Q: The Search Box as a Launch Surface

The Windows Search box, invoked by Win+S or Win+Q (or simply pressing the Windows key and typing), is another viable execution surface. Users can type powershell, cmd, or terminal into the Search box, right-click the result, and select "Run as administrator." A ClickFix lure can instruct users to do exactly this, framing it as a diagnostic step. The Search box also accepts direct command input in some configurations, and the "Open" action on a search result for a system utility launches that utility.

The process lineage here is different again. A shell launched via Windows Search typically shows SearchHost.exe (Windows 11) or SearchUI.exe (Windows 10) as the parent, or in some cases svchost.exe hosting the search indexer. This parent process is not one that most ClickFix detection rules account for.

Detection angle: Alert on powershell.exe, cmd.exe, or WindowsTerminal.exe spawned by SearchHost.exe or SearchUI.exe, particularly with encoded or obfuscated command-line arguments. The key behavioral indicator is the same: a shell process launched and immediately executing a pasted command, but the parent process is the distinguishing signal.

Ctrl+Shift+Esc: Task Manager as a Run Dialog Equivalent

Task Manager, opened via Ctrl+Shift+Esc, contains a "Run new task" option under File > Run new task that functions as a Run dialog equivalent. Critically, this dialog includes a "Create this task with administrative privileges" checkbox. A ClickFix lure can instruct users to open Task Manager, click "Run new task," check the admin box, paste the command, and execute. The user believes they are performing a system repair or verification step.

This path is particularly concerning because Task Manager is universally recognized as a legitimate system tool, and opening it is a common troubleshooting action. The resulting process lineage shows Taskmgr.exe as the parent process for the spawned shell. Very few detection rules monitor for Taskmgr.exe spawning powershell.exe or cmd.exe with suspicious arguments, because this parent-child relationship is uncommon in normal operation.

Detection angle: Create detection rules for Taskmgr.exe spawning powershell.exe, cmd.exe, or mshta.exe. This is a low-noise detection opportunity: legitimate use of Task Manager's "Run new task" feature to launch PowerShell with encoded commands is essentially nonexistent in normal enterprise environments.

File Explorer Address Bar and Browser URI Protocol Handlers

The File Explorer address bar accepts commands and paths directly. Typing powershell or cmd into the Explorer address bar and pressing Enter launches a shell session with explorer.exe as the parent, producing process lineage similar to the Win+R path but originating from a different user interaction. A ClickFix lure can instruct users to open any folder, click the address bar, and paste a command.

More concerning are browser address bar and URI protocol handler abuse vectors. Windows registers several URI protocol handlers that can trigger system utilities from a browser context. Two well-documented examples:

• search-ms: triggers Windows Search from the browser. An attacker-controlled page can use search-ms: to open a Windows Search window pointing to a remote WebDAV share, displaying attacker-controlled files (such as malicious .lnk shortcuts) as if they were local search results. The user sees what looks like a normal search result and double-clicks a file that executes attacker-supplied code.
• ms-msdt: was the handler behind the Follina vulnerability (CVE-2022-30190). Though Microsoft has since disabled ms-msdt: handler functionality, the broader pattern of URI protocol handler abuse remains viable. Other registered handlers (e.g., ms-officecmd:) can serve similar purposes.

In these cases, the browser process (chrome.exe, msedge.exe, firefox.exe) is the parent that triggers the protocol handler, which in turn spawns the system utility. This creates a three-level process chain: browser to protocol handler to payload execution.

Detection angle: Monitor for explorer.exe launching shell processes where the command line contains download cradles or encoded content. For URI handler abuse, watch for browser processes spawning unexpected children like SearchProtocolHost.exe or other system utilities. Log and alert on search-ms: protocol invocations, particularly those referencing remote UNC paths or WebDAV locations.

Portable Python and Runtime Bundling

Several ClickFix campaigns have reportedly bundled a portable Python runtime (typically Python 3.x embeddable packages, approximately 15 MB) as part of the payload delivery. The logic is straightforward: rather than hoping the target machine has Python installed, the attacker ships a self-contained runtime. The initial PowerShell command downloads and extracts the portable environment, then uses it to execute Python-based second-stage payloads. This guarantees execution on any Windows system regardless of what software is installed.

This approach defeats detection strategies that rely on Python not being present in most enterprise environments. The Python binary runs from a user-writable temporary directory, not from Program Files, making the execution path itself a useful detection signal.

Note: The portable Python bundling trend is based on analyst observation of multiple campaign artifacts. Specific campaign reports documenting this technique in detail have not been published as of this report's date.

Linux Variants and macOS Expansion

Linux-targeted ClickFix campaigns typically instruct users to open a terminal emulator and paste a curl | bash or wget | sh one-liner. The social engineering adapts to the platform: fake package manager errors, repository verification prompts, or software dependency fixes serve as lures. The terminal-paste mechanic translates directly because Linux users are more accustomed to copying and pasting terminal commands from web sources, which paradoxically may make them more susceptible to this specific attack pattern.

macOS variants follow a similar model, instructing users to open Terminal.app and paste commands. The clipboard-to-terminal pipeline works identically across platforms; only the payload and lure adapt.

MITRE ATT&CK Mapping

Detection and Hunting

Process lineage is the primary detection surface. Each Windows execution entry point produces a distinct parent-child relationship:

Build detection rules for each of these parent-child combinations with suspicious command-line content. Key command-line indicators include:

• Base64-encoded PowerShell (-e, -enc, -EncodedCommand)
• Download cradles (IEX, Invoke-WebRequest, Invoke-RestMethod, Start-BitsTransfer, certutil -urlcache, bitsadmin /transfer)
• Clipboard-related commands (Get-Clipboard, [System.Windows.Forms.Clipboard])
• Execution from user-writable temp directories (%TEMP%, %APPDATA%)
• Python execution from non-standard paths (python.exe running from %TEMP% or %USERPROFILE%\Downloads)

Network-level indicators: Monitor for connections to recently compromised Ghost CMS instances serving ClickFix overlays. Look for HTML responses from known-good domains that suddenly contain JavaScript clipboard manipulation functions (navigator.clipboard.writeText, document.execCommand('copy')) or inline PowerShell strings.

Ghost CMS defense: Organizations running Ghost CMS versions 3.24.0 through 6.19.0 should treat CVE-2026-26980 patching as critical priority [1]. Check for unauthorized Admin API key creation and review all published content for injected JavaScript or iframe overlays.

Analysis

ClickFix represents a significant challenge for endpoint security architectures that assume malicious code arrives via files, links, or network payloads. The technique routes execution through a channel that most security stacks do not inspect: the user's clipboard, combined with manual invocation of a trusted system utility. The expansion beyond the Win+R Run dialog to multiple Windows execution surfaces (WinX menu, Search, Task Manager, Explorer address bar, URI protocol handlers) means defenders cannot build a single detection rule and consider it sufficient. Each entry point requires its own parent-process monitoring logic.

The Ghost CMS campaign is the clearest signal that ClickFix operators are investing in supply-chain-adjacent techniques. Compromising 700+ legitimate websites and injecting overlays that mimic real Cloudflare challenges moves this technique into territory where traditional URL filtering provides limited protection [1]. Users trust the domain. The browser trusts the domain. Threat intel feeds may not flag the domain for days or weeks.

The experimentation by state-sponsored actors (TA427, TA450, TA422, UNK_RemoteRogue) suggests that the technique is assessed as operationally useful even by groups with access to zero-days and custom tooling, though Proofpoint noted that no actor demonstrated sustained adoption in subsequent campaigns at the time of their April 2025 report [3]. ClickFix's value to these groups is likely its low development cost and high initial success rate against targets who would otherwise be cautious about opening attachments.

References

1. QiAnXin XLab, "ClickFix Campaign Exploits Ghost CMS CVE-2026-26980," May 2026. See also: SecurityWeek, "Ghost CMS Vulnerability Exploited to Hack Over 700 Websites," May 2026. https://www.securityweek.com/ghost-cms-vulnerability-exploited-to-hack-over-700-websites/
2. Proofpoint, "From Clipboard to Compromise: A PowerShell Self-Pwn," June 2024. https://www.proofpoint.com/us/blog/threat-insight/clipboard-compromise-powershell-self-pwn
3. Proofpoint, "Around the World in 90 Days: State-Sponsored Actors Try ClickFix," April 2025. https://www.proofpoint.com/us/blog/threat-insight/around-world-90-days-state-sponsored-actors-try-clickfix
4. Microsoft Security Blog, "Think before you Click(Fix): Analyzing the ClickFix social engineering technique," August 2025. https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/

Event Timeline

Entity Relationships

Diamond Model

Hunt Guide: ClickFix Social Engineering Framework — Shortcut Abuse, Portable Python Payloads, and Ghost CMS Infrastructure Hijacking

Attribution: Detection logic below credits its original author. Rules adapted, ported, or quoted from a public source retain that source's author (e.g. SigmaHQ / Florian Roth, Elastic, Emerging Threats, Abuse.ch, or the cited vendor/researcher). Only rules explicitly marked RedSheep Security/Stone (original) were authored in-house. If you reuse a rule, preserve its stated attribution.

Hypothesis: If ClickFix social engineering techniques are active in our environment, we expect to observe suspicious parent-child process relationships (explorer.exe, SearchHost.exe, SearchUI.exe, or Taskmgr.exe spawning powershell.exe, cmd.exe, or mshta.exe with encoded/obfuscated command-line arguments), Python executables running from temporary directories, clipboard-related PowerShell commands, and outbound connections to recently compromised Ghost CMS domains in process creation logs, PowerShell script block logs, Sysmon telemetry, and proxy/DNS logs.

Intelligence Summary: ClickFix has matured from a simple clipboard-paste social engineering trick into a platform-agnostic delivery framework used by both criminal and state-sponsored actors (TA427/Kimsuky, TA450/MuddyWater, TA422/APT28, UNK_RemoteRogue). Attackers now exploit multiple Windows execution entry points beyond Win+R (including WinX menu, Windows Search, Task Manager, and URI protocol handlers), bundle portable Python runtimes for guaranteed execution, and have compromised 700+ legitimate Ghost CMS websites via CVE-2026-26980 to inject fake CAPTCHA overlays that deliver clipboard-loaded malicious commands to unsuspecting users.

Confidence: Moderate | Priority: High

Scope

• Networks: All enterprise Windows, macOS, and Linux endpoints with user-interactive sessions. Prioritize endpoints used for web browsing and email access. Include Ghost CMS servers in the DMZ or cloud infrastructure for CVE-2026-26980 vulnerability assessment.
• Timeframe: 30-day retrospective hunt recommended (covering May 2026 campaign activity). Ongoing continuous monitoring recommended for process lineage and PowerShell script block detections.
• Priority Systems: User workstations with web browser access (primary ClickFix target surface), executive and privileged user endpoints, systems running Ghost CMS versions 3.24.0-6.19.0, systems with Python detected in user-writable directories, domain controllers and servers accessible from compromised workstations.

MITRE ATT&CK Techniques

T1204 — User Execution (Execution) [P2]

ClickFix instructs victims to manually paste attacker-supplied commands into system utilities (Run dialog, PowerShell, Terminal, Task Manager). The user acts as the execution engine, bypassing automated security controls. Fake CAPTCHA/Cloudflare overlays and browser error messages serve as the social engineering lure.

Splunk SPL:

index=* sourcetype IN ("XmlWinEventLog:Microsoft-Windows-Sysmon/Operational", "WinEventLog:Security") EventCode IN (1, 4688) (ParentImage="*\\explorer.exe" OR ParentImage="*\\SearchHost.exe" OR ParentImage="*\\SearchUI.exe" OR ParentImage="*\\Taskmgr.exe" OR ParentImage="*\\WindowsTerminal.exe") (Image="*\\powershell.exe" OR Image="*\\cmd.exe" OR Image="*\\mshta.exe" OR Image="*\\pwsh.exe") | eval suspicious_args=if(match(CommandLine, "(?i)(-e\s|-enc\s|-EncodedCommand\s|IEX|Invoke-WebRequest|Invoke-RestMethod|Start-BitsTransfer|certutil.*-urlcache|bitsadmin.*transfer|Get-Clipboard|System\.Windows\.Forms\.Clipboard|downloadstring|downloadfile|FromBase64String)"), "true", "false") | where suspicious_args="true" | table _time, ComputerName, User, ParentImage, Image, CommandLine | sort -_time

Elastic KQL:

(process.parent.name:("explorer.exe" OR "SearchHost.exe" OR "SearchUI.exe" OR "Taskmgr.exe" OR "WindowsTerminal.exe")) AND (process.name:("powershell.exe" OR "cmd.exe" OR "mshta.exe" OR "pwsh.exe")) AND process.command_line:(*-enc* OR *-EncodedCommand* OR *IEX* OR *Invoke-WebRequest* OR *Invoke-RestMethod* OR *Start-BitsTransfer* OR *certutil* OR *bitsadmin* OR *Get-Clipboard* OR *downloadstring* OR *FromBase64String*)

Sigma Rule:

title: ClickFix User Execution via Multiple Windows Entry Points
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
author: RedSheep Security/Stone
date: 2026/05/28
description: Detects suspicious shell execution spawned from multiple Windows entry points commonly abused by ClickFix social engineering attacks including Run dialog, Windows Search, Task Manager, and Explorer.
references:
    - https://www.proofpoint.com/us/blog/threat-insight/clipboard-compromise-powershell-self-pwn
    - https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\explorer.exe'
            - '\SearchHost.exe'
            - '\SearchUI.exe'
            - '\Taskmgr.exe'
            - '\WindowsTerminal.exe'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\cmd.exe'
            - '\mshta.exe'
    selection_cmdline:
        CommandLine|contains:
            - '-enc '
            - '-e '
            - '-EncodedCommand'
            - 'IEX'
            - 'Invoke-WebRequest'
            - 'Invoke-RestMethod'
            - 'Start-BitsTransfer'
            - 'certutil'
            - 'bitsadmin'
            - 'Get-Clipboard'
            - 'downloadstring'
            - 'FromBase64String'
    condition: selection_parent and selection_child and selection_cmdline
falsepositives:
    - Legitimate administrative scripts launched from Explorer or Task Manager (rare with encoded commands)
    - System administration tools using download cradles
level: high
tags:
    - attack.execution
    - attack.t1204

Attribution: RedSheep Security/Stone (original)

This is the foundational ClickFix detection. Tune by excluding known administrative scripts. The combination of parent process AND suspicious command-line content significantly reduces false positives. Test WinX menu parent processes in your specific Windows version and configuration — they may vary.

T1059.001 — Command and Scripting Interpreter: PowerShell (Execution) [P1]

Primary execution method for ClickFix on Windows. Attacker-supplied PowerShell commands are loaded to clipboard via JavaScript and executed by the user. Commands typically contain Base64-encoded payloads, download cradles (IEX, Invoke-WebRequest), or clipboard-reading functions to execute staged payloads.

Splunk SPL:

index=* sourcetype="XmlWinEventLog:Microsoft-Windows-PowerShell/Operational" EventCode=4104 | eval b64_pattern=if(match(ScriptBlockText, "(?i)(FromBase64String|\[Convert\]::FromBase64|\[System\.Text\.Encoding\])"), 1, 0) | eval download_pattern=if(match(ScriptBlockText, "(?i)(Invoke-WebRequest|Invoke-RestMethod|IEX|Start-BitsTransfer|Net\.WebClient|downloadstring|downloadfile|DownloadData)"), 1, 0) | eval clipboard_pattern=if(match(ScriptBlockText, "(?i)(Get-Clipboard|System\.Windows\.Forms\.Clipboard|clipboard)"), 1, 0) | where b64_pattern=1 OR download_pattern=1 OR clipboard_pattern=1 | table _time, ComputerName, UserID, ScriptBlockText, Path | sort -_time

Elastic KQL:

event.code:"4104" AND powershell.file.script_block_text:(*FromBase64String* OR *Invoke-WebRequest* OR *Invoke-RestMethod* OR *IEX* OR *Start-BitsTransfer* OR *Net.WebClient* OR *downloadstring* OR *Get-Clipboard* OR *System.Windows.Forms.Clipboard*)

Sigma Rule:

title: ClickFix PowerShell Clipboard Access and Download Cradle
id: b2c3d4e5-f6a7-8901-bcde-f12345678901
status: experimental
author: RedSheep Security/Stone
date: 2026/05/28
description: Detects PowerShell script blocks containing clipboard access functions combined with download cradles or Base64 decoding, indicative of ClickFix payload execution.
references:
    - https://www.proofpoint.com/us/blog/threat-insight/clipboard-compromise-powershell-self-pwn
logsource:
    product: windows
    service: powershell-scriptblock
detection:
    selection_clipboard:
        ScriptBlockText|contains:
            - 'Get-Clipboard'
            - 'System.Windows.Forms.Clipboard'
    selection_execution:
        ScriptBlockText|contains:
            - 'Invoke-WebRequest'
            - 'Invoke-RestMethod'
            - 'IEX'
            - 'Invoke-Expression'
            - 'Start-BitsTransfer'
            - 'Net.WebClient'
            - 'downloadstring'
            - 'FromBase64String'
    condition: selection_clipboard or selection_execution
falsepositives:
    - Legitimate automation scripts using clipboard functions
    - Package managers or update scripts using download cradles
level: high
tags:
    - attack.execution
    - attack.t1059.001

Attribution: RedSheep Security/Stone (original)

ScriptBlock logging (EventID 4104) is essential for this detection. Ensure PowerShell ScriptBlock Logging is enabled via GPO. The clipboard access pattern (Get-Clipboard) is particularly indicative of ClickFix and has very few legitimate uses in enterprise environments. Consider whitelisting specific administrative scripts that use download cradles.

T1059.006 — Command and Scripting Interpreter: Python (Execution) [P2]

ClickFix campaigns bundle portable Python runtimes (~15MB embeddable packages) to guarantee execution regardless of local system configuration. The initial PowerShell command downloads and extracts a portable Python environment to a user-writable temp directory, then uses it to execute second-stage payloads.

Splunk SPL:

index=* sourcetype IN ("XmlWinEventLog:Microsoft-Windows-Sysmon/Operational", "WinEventLog:Security") EventCode IN (1, 4688) (Image="*\\python.exe" OR Image="*\\python3.exe" OR Image="*\\pythonw.exe") (Image="*\\Temp\\*" OR Image="*\\AppData\\*" OR Image="*\\Downloads\\*" OR Image="*\\Users\\*\\Desktop\\*") NOT Image="*\\Program Files*" NOT Image="*\\Anaconda*" NOT Image="*\\Python3*" | table _time, ComputerName, User, ParentImage, Image, CommandLine | sort -_time

Elastic KQL:

(process.name:("python.exe" OR "python3.exe" OR "pythonw.exe")) AND (process.executable:(*\\Temp\\* OR *\\AppData\\* OR *\\Downloads\\*)) AND NOT process.executable:(*\\Program?Files\\* OR *\\Anaconda\\*)

Sigma Rule:

title: Portable Python Execution from User-Writable Directory
id: c3d4e5f6-a7b8-9012-cdef-123456789012
status: experimental
author: RedSheep Security/Stone
date: 2026/05/28
description: Detects execution of Python interpreter from temporary or user-writable directories, indicative of ClickFix portable Python runtime bundling technique.
references:
    - https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/
logsource:
    category: process_creation
    product: windows
detection:
    selection_python:
        Image|endswith:
            - '\python.exe'
            - '\python3.exe'
            - '\pythonw.exe'
    selection_path:
        Image|contains:
            - '\Temp\'
            - '\AppData\'
            - '\Downloads\'
            - '\Desktop\'
    filter_legitimate:
        Image|contains:
            - '\Program Files\'
            - '\Program Files (x86)\'
            - '\Anaconda'
    condition: selection_python and selection_path and not filter_legitimate
falsepositives:
    - Developers using portable Python environments in user directories
    - Data science tools extracting Python to AppData
level: high
tags:
    - attack.execution
    - attack.t1059.006

Attribution: RedSheep Security/Stone (original)

In most enterprise environments, Python should not be running from Temp, AppData, or Downloads directories. Coordinate with development teams to whitelist known legitimate portable Python installations. Also hunt for the download and extraction of Python embeddable packages (look for python-3.-embed-.zip in web proxy logs).

T1059.004 — Command and Scripting Interpreter: Unix Shell (Execution) [P2]

Linux/macOS ClickFix variants instruct users to open a terminal and paste curl|bash or wget|sh one-liners. Social engineering uses fake package manager errors, repository verification prompts, or dependency fix lures.

Splunk SPL:

index=* sourcetype IN ("linux:auditd", "osquery:results", "linux_audit") (process_name="bash" OR process_name="sh" OR process_name="zsh") (cmdline="*curl*|*bash*" OR cmdline="*curl*|*sh*" OR cmdline="*wget*|*bash*" OR cmdline="*wget*|*sh*" OR cmdline="*curl*-s*http*" OR cmdline="*wget*-q*http*") | table _time, host, user, parent_process, process_name, cmdline | sort -_time

Elastic KQL:

(process.name:("bash" OR "sh" OR "zsh")) AND process.command_line:(*curl* AND (*bash* OR *sh* OR *eval*)) OR (process.command_line:(*wget* AND (*bash* OR *sh*)))

Sigma Rule:

title: ClickFix Unix Shell Pipe Execution Pattern
id: d4e5f6a7-b8c9-0123-defa-234567890123
status: experimental
author: RedSheep Security/Stone
date: 2026/05/28
description: Detects curl or wget output piped directly to shell interpreters, a pattern used in Linux/macOS ClickFix campaigns.
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        CommandLine|contains:
            - 'curl '
            - 'wget '
    filter_pipe:
        CommandLine|contains:
            - '| bash'
            - '| sh'
            - '|bash'
            - '|sh'
            - '| /bin/bash'
            - '| /bin/sh'
    condition: selection and filter_pipe
falsepositives:
    - Legitimate installation scripts (e.g., package managers, Homebrew)
    - DevOps automation using curl|bash patterns
level: medium
tags:
    - attack.execution
    - attack.t1059.004

Attribution: RedSheep Security/Stone (original)

This is a common legitimate pattern in DevOps environments so careful tuning is needed. Focus on workstations rather than build/CI servers. Whitelist known legitimate installer URLs (e.g., Homebrew, nvm, rustup).

T1059.007 — Command and Scripting Interpreter: JavaScript (Execution) [P2]

JavaScript on attacker-controlled or compromised pages silently loads malicious commands to the user's clipboard using navigator.clipboard.writeText() or document.execCommand('copy'). This is the staging mechanism that enables the ClickFix paste-and-execute flow.

Splunk SPL:

index=* sourcetype IN ("proxy", "bluecoat", "squid", "pan:traffic", "stream:http") (url="*ghost*" OR url="*cms*") (response_body="*navigator.clipboard.writeText*" OR response_body="*execCommand*copy*" OR response_body="*powershell*" OR response_body="*-EncodedCommand*" OR response_body="*mshta*") | table _time, src_ip, dest_ip, url, http_user_agent, response_body | sort -_time

Elastic KQL:

http.response.body.content:(*navigator.clipboard.writeText* OR *execCommand*copy*) AND http.response.body.content:(*powershell* OR *cmd.exe* OR *mshta* OR *EncodedCommand*)

Detection requires HTTP response body inspection, which many environments do not log by default. Consider deploying content inspection on proxy/NGFW for high-risk user populations. Look for clipboard manipulation JavaScript on pages that also contain PowerShell or cmd.exe strings in the response body.

T1189 — Drive-by Compromise (Initial Access) [P2]

Over 700 legitimate Ghost CMS websites were compromised via CVE-2026-26980 and injected with fake Cloudflare/CAPTCHA verification overlays that deliver ClickFix payloads. Users visiting trusted domains encounter these overlays and follow instructions to paste malicious commands.

Splunk SPL:

index=* sourcetype IN ("proxy", "bluecoat", "squid", "pan:traffic") (url="*captcha*" OR url="*cloudflare*verify*" OR url="*challenge*") (http_content_type="text/html") | eval suspicious=if(match(url, "(?i)(captcha|verify|challenge)") AND match(response_body, "(?i)(clipboard|powershell|cmd\.exe|mshta)"), "true", "false") | where suspicious="true" | stats count by src_ip, dest_ip, url, http_user_agent | sort -count

Elastic KQL:

url.full:(*captcha* OR *cloudflare*verify* OR *challenge*) AND http.response.body.content:(*clipboard* OR *powershell* OR *cmd.exe* OR *mshta*)

This detection relies on content inspection of HTTP responses from legitimate domains. The key indicator is the co-occurrence of CAPTCHA/verification-themed content with PowerShell or command-line strings in the response body. Domain reputation alone will not catch this since the infrastructure is legitimate.

T1190 — Exploit Public-Facing Application (Initial Access) [P1]

CVE-2026-26980 is an unauthenticated SQL injection vulnerability (CVSS 9.4) in Ghost CMS Content API slug filter ordering, affecting versions 3.24.0 through 6.19.0. Attackers exploit this to steal Admin API keys and inject malicious JavaScript overlays into published content.

Splunk SPL:

index=* sourcetype IN ("waf", "modsecurity", "aws:waf", "pan:threat") (uri_path="*/ghost/api/*" OR uri_path="*/api/content/*") (http_method="GET" OR http_method="POST") (attack_type="sqli" OR attack_category="sql_injection" OR uri_query="*order*" OR uri_query="*slug*") | stats count by src_ip, dest_ip, uri_path, uri_query, http_method, action | where count > 5 | sort -count

Elastic KQL:

url.path:(*ghost*api* OR *api*content*) AND (url.query:(*order* OR *slug* OR *UNION* OR *SELECT*) OR event.category:"web") AND event.outcome:"success"

Organizations running Ghost CMS should immediately check version and patch to 6.19.1+ or 5.120.1+. Even after patching, audit published content for injected JavaScript or iframe overlays — patching does not remove existing injections. Monitor for unauthorized Admin API key creation in Ghost admin logs.

T1036 — Masquerading (Defense Evasion) [P2]

Attackers inject fake Cloudflare verification and CAPTCHA overlays into compromised Ghost CMS pages. These overlays are visually indistinguishable from legitimate Cloudflare challenges, masquerading as legitimate security verification to trick users into executing clipboard-loaded commands.

Splunk SPL:

index=* sourcetype IN ("proxy", "bluecoat", "squid") (url!="*cloudflare.com*" AND url!="*challenges.cloudflare.com*") (response_body="*Verify you are human*" OR response_body="*cloudflare-challenge*" OR response_body="*cf-turnstile*" OR response_body="*I am not a robot*") | table _time, src_ip, dest_ip, url, response_body | sort -_time

Elastic KQL:

NOT url.domain:"challenges.cloudflare.com" AND NOT url.domain:"cloudflare.com" AND http.response.body.content:(*Verify?you?are?human* OR *cloudflare-challenge* OR *cf-turnstile*)

Look for Cloudflare-themed challenge content served from domains that are NOT actual Cloudflare infrastructure. This requires HTTP response body inspection. The fake overlays may reference Cloudflare CSS/JS assets from attacker-controlled domains.

T1053.005 — Scheduled Task/Job: Scheduled Task (Persistence) [P2]

TA427 (Kimsuky) ClickFix campaigns used scheduled tasks running VBScripts at regular intervals for persistence after initial ClickFix execution.

Splunk SPL:

index=* sourcetype IN ("XmlWinEventLog:Microsoft-Windows-Sysmon/Operational", "WinEventLog:Security", "WinEventLog:Microsoft-Windows-TaskScheduler/Operational") (EventCode=4698 OR EventCode=106 OR (EventCode=1 AND Image="*\\schtasks.exe")) | eval sus_task=if(match(CommandLine, "(?i)(vbscript|wscript|cscript|powershell|cmd\.exe.*\/c|mshta|http|%TEMP%|%APPDATA%)"), "true", "false") | where sus_task="true" | table _time, ComputerName, User, CommandLine, TaskName | sort -_time

Elastic KQL:

(event.code:"4698" OR (process.name:"schtasks.exe" AND process.command_line:(*vbscript* OR *wscript* OR *cscript* OR *powershell* OR *mshta* OR *http* OR *TEMP* OR *APPDATA*)))

Sigma Rule:

title: Scheduled Task Created for ClickFix Persistence via VBScript
id: e5f6a7b8-c9d0-1234-efab-345678901234
status: experimental
author: RedSheep Security/Stone
date: 2026/05/28
description: Detects creation of scheduled tasks that execute VBScript or scripting interpreters from user-writable paths, consistent with TA427 ClickFix persistence mechanism.
references:
    - https://www.proofpoint.com/us/blog/threat-insight/around-world-90-days-state-sponsored-actors-try-clickfix
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4698
    filter_content:
        TaskContent|contains:
            - 'wscript'
            - 'cscript'
            - '.vbs'
            - 'powershell'
            - 'mshta'
    filter_path:
        TaskContent|contains:
            - '\Temp\'
            - '\AppData\'
            - '\Downloads\'
    condition: selection and filter_content and filter_path
falsepositives:
    - Legitimate scheduled tasks using VBScript for administrative purposes from temp directories (uncommon)
level: high
tags:
    - attack.persistence
    - attack.t1053.005

Attribution: RedSheep Security/Stone (original)

Correlate scheduled task creation with preceding ClickFix-style execution patterns (clipboard access, encoded PowerShell) within a short time window (minutes). TA427 specifically used VBScript-based persistence running at regular intervals.

T1218.005 — System Binary Proxy Execution: Mshta (Defense Evasion) [P1]

ClickFix campaigns use mshta.exe as an alternative to PowerShell for executing attacker-supplied commands via the Run dialog and other Windows execution surfaces. Mshta can execute HTA content from URLs, making it a versatile execution proxy.

Splunk SPL:

index=* sourcetype IN ("XmlWinEventLog:Microsoft-Windows-Sysmon/Operational", "WinEventLog:Security") EventCode IN (1, 4688) Image="*\\mshta.exe" (CommandLine="*http*" OR CommandLine="*javascript*" OR CommandLine="*vbscript*" OR CommandLine="*about:*") | table _time, ComputerName, User, ParentImage, Image, CommandLine | sort -_time

Elastic KQL:

process.name:"mshta.exe" AND process.command_line:(*http* OR *javascript* OR *vbscript* OR *about:*)

Sigma Rule:

title: Mshta Execution with Remote or Script Content
id: f6a7b8c9-d0e1-2345-fabc-456789012345
status: experimental
author: RedSheep Security/Stone
date: 2026/05/28
description: Detects mshta.exe execution with URLs or inline script content in command line, common in ClickFix attack chains.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\mshta.exe'
    selection_args:
        CommandLine|contains:
            - 'http://'
            - 'https://'
            - 'javascript:'
            - 'vbscript:'
            - 'about:'
    condition: selection and selection_args
falsepositives:
    - Legitimate HTA applications (should be known and whitelisted)
level: high
tags:
    - attack.defense_evasion
    - attack.t1218.005

Attribution: RedSheep Security/Stone (original)

Mshta.exe executing content from URLs is almost always malicious in enterprise environments. Whitelist known legitimate HTA applications by hash or path. Pay special attention to mshta.exe spawned by explorer.exe (Win+R path) or Taskmgr.exe.

T1106 — Native API (Execution) [P1]

ClickFix abuses the search-ms: URI protocol handler to trigger Windows Search from a browser context, displaying attacker-controlled files from remote WebDAV shares as if they were local search results. This leverages native Windows API and protocol handler functionality.

Splunk SPL:

index=* sourcetype IN ("XmlWinEventLog:Microsoft-Windows-Sysmon/Operational", "WinEventLog:Security") EventCode IN (1, 4688) (CommandLine="*search-ms:*" OR CommandLine="*search:*") | eval remote_ref=if(match(CommandLine, "(?i)(\\\\|http|webdav|smb)"), "true", "false") | table _time, ComputerName, User, ParentImage, Image, CommandLine, remote_ref | sort -_time

Elastic KQL:

process.command_line:(*search-ms\:* OR *search\:*) AND process.command_line:(*\\\\* OR *http* OR *webdav*)

Sigma Rule:

title: Search-ms URI Protocol Handler Abuse for Remote File Access
id: a7b8c9d0-e1f2-3456-abcd-567890123456
status: experimental
author: RedSheep Security/Stone
date: 2026/05/28
description: Detects invocation of search-ms URI protocol handler referencing remote UNC paths or WebDAV locations, a technique used in ClickFix to display attacker-controlled files as local search results.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains: 'search-ms:'
    filter_remote:
        CommandLine|contains:
            - '\\\\'
            - 'http'
            - 'webdav'
    condition: selection and filter_remote
falsepositives:
    - Legitimate use of search-ms protocol handler with remote locations (very rare)
level: high
tags:
    - attack.execution
    - attack.t1106

Attribution: RedSheep Security/Stone (original)

Consider blocking search-ms: protocol handler invocations from browser processes via Group Policy. Any search-ms: invocation referencing a remote UNC path or WebDAV location should be treated as highly suspicious. This technique was previously associated with Follina-adjacent attacks.

Indicators of Compromise

IOC Sweep Queries (Splunk):

index=* sourcetype IN ("dns", "proxy", "bluecoat", "squid", "pan:traffic", "stream:dns") (query="*clo4shara.xyz*" OR url="*clo4shara.xyz*" OR dest="*clo4shara.xyz*" OR answer="*clo4shara.xyz*") | stats count by _time, src_ip, dest_ip, query, url | sort -_time

index=* sourcetype IN ("proxy", "bluecoat", "squid", "XmlWinEventLog:Microsoft-Windows-Sysmon/Operational") (url="*python*embed*zip*" OR TargetFilename="*python*embed*zip*" OR filename="*python*embed*zip*") | table _time, src_ip, dest_ip, url, TargetFilename, ComputerName | sort -_time

YARA Rules

clickfix_html_clipboard_injection — Detects HTML/JavaScript pages containing clipboard manipulation code combined with PowerShell or command-line strings, indicative of ClickFix social engineering overlays injected into compromised websites.

rule clickfix_html_clipboard_injection {
    meta:
        author = "RedSheep Security/Stone"
        description = "Detects ClickFix HTML pages with clipboard manipulation and PowerShell/cmd payload strings"
        date = "2026-05-28"
        reference = "https://www.proofpoint.com/us/blog/threat-insight/clipboard-compromise-powershell-self-pwn"
    strings:
        $clipboard1 = "navigator.clipboard.writeText" ascii wide
        $clipboard2 = "document.execCommand('copy')" ascii wide
        $clipboard3 = "document.execCommand(\"copy\")" ascii wide
        $clipboard4 = "clipboard.writeText" ascii wide
        $payload1 = "powershell" ascii wide nocase
        $payload2 = "cmd.exe" ascii wide nocase
        $payload3 = "mshta" ascii wide nocase
        $payload4 = "-EncodedCommand" ascii wide nocase
        $payload5 = "Invoke-WebRequest" ascii wide nocase
        $payload6 = "IEX" ascii wide
        $payload7 = "Start-BitsTransfer" ascii wide nocase
        $lure1 = "Verify you are human" ascii wide nocase
        $lure2 = "Press Win" ascii wide nocase
        $lure3 = "Ctrl+V" ascii wide nocase
        $lure4 = "paste" ascii wide nocase
        $lure5 = "Run dialog" ascii wide nocase
    condition:
        filesize < 5MB and
        (1 of ($clipboard*)) and
        (1 of ($payload*)) and
        (1 of ($lure*))
}

Attribution: RedSheep Security/Stone (original)

clickfix_portable_python_dropper — Detects PowerShell scripts or batch files that download and extract portable Python embeddable packages to user-writable directories, consistent with ClickFix portable runtime bundling technique.

rule clickfix_portable_python_dropper {
    meta:
        author = "RedSheep Security/Stone"
        description = "Detects scripts that download and deploy portable Python embeddable packages"
        date = "2026-05-28"
    strings:
        $python_embed1 = "python-3" ascii wide nocase
        $python_embed2 = "embed" ascii wide nocase
        $python_embed3 = ".zip" ascii wide nocase
        $download1 = "Invoke-WebRequest" ascii wide nocase
        $download2 = "Start-BitsTransfer" ascii wide nocase
        $download3 = "Net.WebClient" ascii wide nocase
        $download4 = "DownloadFile" ascii wide nocase
        $download5 = "certutil" ascii wide nocase
        $download6 = "bitsadmin" ascii wide nocase
        $extract1 = "Expand-Archive" ascii wide nocase
        $extract2 = "tar" ascii wide nocase
        $extract3 = "unzip" ascii wide nocase
        $extract4 = "ZipFile" ascii wide nocase
        $path1 = "\\Temp\\" ascii wide
        $path2 = "\\AppData\\" ascii wide
        $path3 = "%TEMP%" ascii wide
        $path4 = "%APPDATA%" ascii wide
    condition:
        filesize < 100KB and
        (1 of ($python_embed*)) and
        (1 of ($download*)) and
        (1 of ($extract*) or 1 of ($path*))
}

Attribution: RedSheep Security/Stone (original)

Suricata Rules

SID 2026001 — Detects DNS query to ClickFix C2 domain clo4shara.xyz associated with Ghost CMS ClickFix campaign

alert dns $HOME_NET any -> any any (msg:"REDSHEEP ClickFix C2 Domain - clo4shara.xyz"; dns.query; content:"clo4shara.xyz"; nocase; reference:url,www.securityweek.com/ghost-cms-vulnerability-exploited-to-hack-over-700-websites/; classtype:trojan-activity; sid:2026001; rev:1; metadata:created_at 2026_05_28;)

Attribution: RedSheep Security/Stone (original)

SID 2026002 — Detects HTTP response containing clipboard manipulation JavaScript combined with PowerShell strings, indicative of ClickFix overlay injection on compromised websites

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"REDSHEEP ClickFix Clipboard Manipulation with PowerShell in HTTP Response"; flow:established,to_client; file_data; content:"navigator.clipboard.writeText"; nocase; content:"powershell"; nocase; distance:0; within:5000; reference:url,www.proofpoint.com/us/blog/threat-insight/clipboard-compromise-powershell-self-pwn; classtype:trojan-activity; sid:2026002; rev:1; metadata:created_at 2026_05_28;)

Attribution: RedSheep Security/Stone (original)

SID 2026003 — Detects HTTP request to Ghost CMS Content API with potential SQL injection payload in slug ordering parameter (CVE-2026-26980)

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"REDSHEEP Ghost CMS CVE-2026-26980 SQL Injection Attempt - Content API"; flow:established,to_server; http.uri; content:"/ghost/api/"; nocase; content:"content/"; nocase; distance:0; content:"order"; nocase; pcre:"/order[^&]*(?:UNION|SELECT|INSERT|UPDATE|DELETE|DROP|CONCAT|CHAR|0x[0-9a-fA-F])/Ui"; reference:cve,2026-26980; classtype:web-application-attack; sid:2026003; rev:1; metadata:created_at 2026_05_28;)

Attribution: RedSheep Security/Stone (original)

SID 2026004 — Detects HTTP download of portable Python embeddable package, commonly used in ClickFix runtime bundling attacks

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"REDSHEEP Portable Python Embeddable Package Download - Potential ClickFix"; flow:established,to_client; http.uri; content:"python"; nocase; content:"embed"; nocase; distance:0; content:".zip"; nocase; distance:0; filestore; reference:url,www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/; classtype:policy-violation; sid:2026004; rev:1; metadata:created_at 2026_05_28;)

Attribution: RedSheep Security/Stone (original)

SID 2026005 — Detects search-ms URI protocol handler invocation in HTTP traffic referencing remote UNC/WebDAV paths

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"REDSHEEP search-ms Protocol Handler Abuse with Remote Path"; flow:established,to_client; file_data; content:"search-ms:"; nocase; pcre:"/search-ms:[^"']*(?:\\\\|http)/i"; classtype:trojan-activity; sid:2026005; rev:1; metadata:created_at 2026_05_28;)

Attribution: RedSheep Security/Stone (original)

Data Source Requirements

Mitigations & Recommendations

Curated baseline: Kimsuky; library archetype

The curated Kimsuky playbook covers spearphishing lures, DMARC abuse, browser credential theft, mailbox persistence, and standard foothold/containment steps. This incident introduces the ClickFix social-engineering framework where users self-execute clipboard-loaded commands, plus new delivery via compromised Ghost CMS sites (CVE-2026-26980), portable Python runtime payloads, mshta/search-ms LOLBin abuse, and scheduled-task VBScript persistence — none of which the curated playbook addresses.

Established mitigations (curated):

• Isolate compromised host at EDR.
• Reset user password; revoke sessions.
• ZAP/purge the phishing email from all mailboxes.
• Block sender infrastructure (domains, IPs, email patterns).
• Remove any inbox rules or delegate permissions attacker set.

Established detection guidance (curated):

• Review the phishing email: impersonated identity, lure theme, delivery method.
• Identify all recipients of the same lure.
• Check for clickers / attachment executors.
• Endpoint hunt on clickers: LNK execution, macro-doc execution, PowerShell post-click.
• Credential access / browser credential theft hunt (Kimsuky steals browser creds).
• DMARC audit: how poorly is our own and partner domain DMARC configured (CISA AA23-271A guidance)?

Net-new from this incident:

• Add user awareness content specifically for ClickFix: no legitimate CAPTCHA or Cloudflare check ever asks a user to press Win+R and paste a command.
• Establish a detection for MRU entries in HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU containing powershell/mshta/cmd — a direct forensic artifact of ClickFix.
• Inventory internally hosted Ghost CMS instances and confirm patched above 6.19.0 given CVE-2026-26980 (CVSS 9.4) exploitation in the wild.
• Extend Kimsuky/TA427 hunts beyond spearphishing to include drive-by ClickFix delivery, since TA427 has adopted the technique for initial access.
• Deploy AppLocker/WDAC rule or EDR block preventing explorer.exe from spawning powershell.exe, mshta.exe, and wscript.exe (Run-dialog abuse path). (Why: T1204 / T1059.001 / T1218.005 — ClickFix relies on Run dialog spawning these interpreters.)
• Block clipboard-write JavaScript on uncategorized sites via browser policy, or disable navigator.clipboard.writeText for untrusted zones. (Why: T1059.007 — ClickFix stages payloads via silent clipboard writes.)
• Block known ClickFix distribution and Ghost-CMS-injected domains at web proxy/DNS; sinkhole search-ms: and WebDAV outbound where not required. (Why: T1189 / T1106 — compromised Ghost sites and search-ms remote retrieval are active delivery vectors.)
• Alert/block execution of python.exe from user-writable paths (%TEMP%, %APPDATA%, user profile). (Why: T1059.006 — portable Python embeddable runtime executed from user-writable directories.)
• Detect: Identify users who opened the Windows Run dialog (Win+R) or Terminal shortly before PowerShell/mshta execution — the ClickFix human-as-execution-engine signature. (Why: T1204 / T1059.001 ClickFix instructs user to paste attacker commands into Run dialog or PowerShell.)
• Detect: Review web proxy/browser history for visits to Ghost CMS sites presenting Cloudflare/CAPTCHA overlays in the hours before suspicious PowerShell execution. (Why: T1189 / T1190 — 700+ Ghost CMS sites compromised via CVE-2026-26980 delivering fake CAPTCHA ClickFix overlays.)
• Detect: Check for portable Python runtime artifacts (python.exe outside Program Files, ~15MB embeddable zip extractions in %TEMP%, %APPDATA%, or user profile). (Why: T1059.006 — ClickFix bundles portable Python embeddable packages to guarantee execution.)
• Detect: On macOS/Linux endpoints, hunt for terminal history containing curl|bash or wget|sh one-liners tied to fake package-manager or dependency prompts. (Why: T1059.004 — cross-platform ClickFix variants target macOS/Linux via terminal paste.)

Sources

• QiAnXin XLab / SecurityWeek - Ghost CMS Vulnerability Exploited to Hack Over 700 Websites (CVE-2026-26980)
• Proofpoint - From Clipboard to Compromise: A PowerShell Self-Pwn (June 2024)
• Proofpoint - Around the World in 90 Days: State-Sponsored Actors Try ClickFix (April 2025)
• Microsoft Security Blog - Think before you Click(Fix): Analyzing the ClickFix social engineering technique (August 2025)