Back to Intelligence

Cisco Unpatched Flaw, AI Agent RCE, and the ClickFix Surge: A Defender's Playbook for Trusted-Path Attacks

SA
Security Arsenal Team
September 21, 2026
11 min read

This week's recap is a case study in a theme I've watched dominate incident queues for the past eighteen months: attackers are no longer battering down the perimeter — they're walking in through the things your users already trust. A still-unpatched Cisco vulnerability leaves network edge devices exposed. A critical remote code execution flaw in an AI agent framework turns developer tooling into an intrusion vector. ClickFix social-engineering campaigns are surging, tricking users into pasting malicious commands into their own Run dialog. And browser hijacking continues to monetize compromised endpoints at scale.

Individually, each of these is manageable. Collectively, they describe an attack surface where the exploit is often the user, the package manager, or the patch you haven't been able to ship yet. If your detection strategy still leans primarily on signature-based alerting for known-bad binaries, you are structurally blind to most of this week's threat set. Here's how to close those gaps.

Technical Analysis

Unpatched Cisco Vulnerability

Cisco disclosed a vulnerability affecting its networking platforms for which a full fix was not yet available at disclosure time. Unpatched network edge devices — IOS XE, ASA, and Firepower families in particular — remain among the highest-value targets we see in IR engagements, because they sit at the trust boundary, typically lack EDR coverage, and offer attackers a stealthy persistence and traffic-interception point. Exploitation of Cisco edge flaws in recent years has consistently enabled implant deployment, configuration tampering, and credential harvesting from device memory.

From a defender's perspective, the critical characteristics:

  • Affected component: Web management interfaces and device services exposed to untrusted networks are the primary exploitation surface. Any Cisco device with a management UI reachable from the internet should be treated as at-risk until confirmed patched.
  • Exploitation requirements: Recent Cisco edge exploits have required only network reachability to the vulnerable service — no authentication, no user interaction.
  • Exploitation status: When Cisco ships an advisory without a patch, assume threat actors are reverse-engineering the advisory itself to build exploits. The window between disclosure and weaponization for network edge flaws has compressed to days, sometimes hours.

AI Agent Critical Code Execution

A critical remote code execution flaw in an AI agent framework underscores a risk class most security programs haven't caught up with: the AI/LLM tooling stack. AI agents by design execute code, call tools, read files, and make network requests — often with the developer's or service account's full privileges. An RCE in the agent orchestration layer means an attacker who can influence the agent's input (via prompt injection, a poisoned data source, or direct API access) achieves arbitrary code execution in a context that is supposed to run code. Traditional appsec controls rarely inspect these pipelines, and agent processes are frequently excluded from EDR policies because they're 'developer tooling.'

Key defensive concerns:

  • Blast radius: Agents typically hold API keys, cloud credentials, and repository access. One compromised agent equals a supply-chain foothold.
  • Detection difficulty: Malicious commands spawned by an agent look like normal agent behavior unless you baseline what the agent should spawn.

The ClickFix Surge

ClickFix (and its variants like FakeCaptcha and fake browser-update lures) has matured from a novelty into one of the most reliable initial-access techniques in circulation. The attack chain:

  1. Victim lands on a compromised or malicious site presenting a fake CAPTCHA, browser error, or 'verification' prompt.
  2. The page instructs the user to press Win+R, paste (the site has already silently written a malicious command to the clipboard via JavaScript), and hit Enter.
  3. The pasted command typically launches mshta.exe, powershell.exe, or wscript.exe pulling a second-stage payload from a remote URL — delivering infostealers (Lumma, StealC, Vidar families) or RATs.

The genius — and the detection challenge — is that the user executes the malware. No exploit, no macro, no attachment. The initial process chain (explorer.exe → Run dialog → powershell/mshta) has a distinctive telemetry signature, which gives us a solid detection opportunity.

Browser Hijacks

Browser hijacking campaigns continue to abuse malicious extensions, search-engine redirection, and extension-store social engineering. Hijacked browsers mean stolen session cookies, injected ads, credential phishing overlays, and — increasingly — a beachhead for follow-on payload delivery. Enterprise-relevant indicators include unexpected extension installations, changed default search providers enforced by policy registry keys, and extensions requesting broad host permissions.

Detection & Response

The following detections target the most actionable behaviors from this week's threat set: ClickFix-style execution chains, suspicious child processes from AI agent tooling, and browser hijack persistence. Every rule is designed to be low-noise in a typical enterprise.

Sigma Rules

YAML
---
title: ClickFix User-Executed Run Dialog Command Spawning Scripting Engine
id: 8c2f4a91-3b7e-4d2a-9f16-5e8c1a7d3b42
status: experimental
description: Detects the ClickFix social engineering execution chain where a user pastes a malicious command into the Windows Run dialog, resulting in explorer.exe spawning mshta, powershell, or wscript with remote URL or encoded payload arguments.
references:
  - https://attack.mitre.org/techniques/T1204/002/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/19
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059.001
  - attack.t1218.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  selection_child:
    Image|endswith:
      - '\mshta.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\cmd.exe'
  selection_suspicious_cmdline:
    CommandLine|contains:
      - 'http://'
      - 'https://'
      - '-enc'
      - '-e '
      - 'FromBase64String'
      - 'IEX'
      - 'Invoke-Expression'
      - 'DownloadString'
      - 'mshta '
  condition: selection_parent and selection_child and selection_suspicious_cmdline
falsepositives:
  - Rare legitimate administrative troubleshooting via Run dialog; verify command content and user context
level: high
---
title: AI Agent or LLM Tooling Spawning Unexpected System Utilities
id: 2f7b1d84-9a3c-4e51-b7d2-6c4a9f1e8d05
status: experimental
description: Detects AI agent frameworks and LLM orchestration processes (python/node-based agents, langchain-style runtimes) spawning system shells, download utilities, or scripting engines — a strong indicator of agent-layer RCE or prompt-injection-driven code execution.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/09/19
tags:
  - attack.execution
  - attack.t1059
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'langchain'
      - 'autogen'
      - 'crewai'
      - 'agent'
      - 'llm'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\curl.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\wscript.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  filter_known_agent_code_exec:
    CommandLine|contains:
      - 'pytest'
      - 'unittest'
      - 'node_modules'
  condition: selection_parent and selection_child and not filter_known_agent_code_exec
falsepositives:
  - Agents explicitly designed to run code or tests; tune the filter to your sanctioned agent workflows and enforce per-agent allowlists
level: high
---
title: Browser Extension Persistence via Enterprise Policy Registry
id: 5d9a3c17-2e48-4b6f-a1c9-7f3e2d8b5a61
status: experimental
description: Detects registry writes forcing browser extension installation or hijacking browser settings via policy keys — a common browser hijack and infostealer persistence technique.
references:
  - https://attack.mitre.org/techniques/T1176/
  - https://attack.mitre.org/techniques/T1547/001/
author: Security Arsenal
date: 2026/09/19
tags:
  - attack.persistence
  - attack.t1176
  - attack.t1547.001
logsource:
  category: registry_set
  product: windows
detection:
  selection_chrome:
    TargetObject|contains:
      - '\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist'
      - '\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist'
  selection_settings_hijack:
    TargetObject|contains:
      - '\SOFTWARE\Policies\Google\Chrome\DefaultSearchProvider'
      - '\SOFTWARE\Policies\Google\Chrome\HomepageLocation'
      - '\SOFTWARE\Policies\Microsoft\Edge\HomepageLocation'
  condition: 1 of selection_*
falsepositives:
  - Legitimate enterprise GPO/MDM deployments of sanctioned extensions; baseline expected values and alert on deviations
level: medium

KQL Hunt (Microsoft Sentinel / Defender)

This query hunts the ClickFix execution chain — scripting engines spawned by explorer.exe with network or encoded content in the command line — plus AI-agent-spawned shells in the same pass.

KQL — Microsoft Sentinel / Defender
let ScriptEngines = dynamic(["mshta.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","cmd.exe"]);
let SuspiciousTokens = dynamic(["http://","https://","-enc","-e ","FromBase64String","IEX","Invoke-Expression","DownloadString","DownloadFile","Start-BitsTransfer"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ (ScriptEngines)
| where InitiatingProcessFileName =~ "explorer.exe"
    or InitiatingProcessCommandLine has_any ("langchain","autogen","crewai","agent","llm")
| where ProcessCommandLine has_any (SuspiciousTokens)
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessId, SHA256
| order by TimeGenerated desc

Companion hunt for browser hijack indicators in network telemetry (unexpected extension-update or search-redirect infrastructure contacted shortly after a new process execution):

KQL — Microsoft Sentinel / Defender
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("chrome.exe","msedge.exe","firefox.exe")
| where RemoteUrl has_any ("update-service","ext-update","search-redirect")
    or RemoteUrl endswith ".top" or RemoteUrl endswith ".click"
| where RemoteUrl !has_any ("google.com","microsoft.com","mozilla.org","mozilla.net")
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated),
            Connections=count() by DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName
| order by Connections asc

Velociraptor VQL

Hunt endpoints for evidence of ClickFix-style execution — Run dialog MRU artifacts combined with suspicious recent process ancestry — useful for scoping after a user reports a fake CAPTCHA page.

VQL — Velociraptor
-- Hunt RunMRU artifacts for pasted commands indicative of ClickFix lures
SELECT Key.Name AS UserKey,
       Data.value AS RunMRUValue
FROM foreach(row={
    SELECT Name FROM glob(globs='HKEY_USERS/*/Software/Microsoft/Windows/CurrentVersion/Explorer/RunMRU/*', accessor='registry')
}, query={
    SELECT Key.Name, Data FROM stat(filename=_key, accessor='registry')
})
WHERE RunMRUValue =~ '(?i)mshta|powershell|wscript|curl|http://|https://'
VQL — Velociraptor
-- Correlate live processes spawned by explorer with script engines and network-bearing command lines
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)mshta|powershell|pwsh|wscript|cscript'
  AND CommandLine =~ '(?i)http://|https://|-enc|frombase64string|iex'

Remediation & Hardening Script

This PowerShell script audits for browser hijack persistence keys, flags suspicious forced-install extensions, and reports RunMRU entries containing script-engine invocations — run it across endpoints via your RMM or as an on-demand triage step when ClickFix exposure is suspected.

PowerShell
# Audit browser policy persistence keys for hijack indicators
$policyPaths = @(
    'HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist',
    'HKCU:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist',
    'HKLM:\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist',
    'HKCU:\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist',
    'HKLM:\SOFTWARE\Policies\Google\Chrome\DefaultSearchProviderSearchURL',
    'HKLM:\SOFTWARE\Policies\Google\Chrome\HomepageLocation'
)
foreach ($path in $policyPaths) {
    if (Test-Path $path) {
        Write-Warning "Policy key present - verify it matches sanctioned GPO/MDM config: $path"
        Get-ItemProperty -Path $path | Format-List
    }
}

# Inspect per-user RunMRU for pasted script-engine commands (ClickFix indicator)
Get-ChildItem 'Registry::HKEY_USERS' | ForEach-Object {
    $mru = "Registry::$($_.PSChildName)\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU"
    if (Test-Path $mru) {
        $props = Get-ItemProperty -Path $mru
        $props.PSObject.Properties | Where-Object {
            $_.Value -match '(?i)mshta|powershell|wscript|http://|https://'
        } | ForEach-Object {
            Write-Warning "Suspicious RunMRU entry for $($_.PSPath): $($_.Value)"
        }
    }
}

# Confirm AMSI and Script Block Logging are enabled to support ClickFix detection
$amsi = Get-MpPreference
if ($amsi.DisableScriptScanning -eq $true) { Write-Warning 'Defender script scanning (AMSI) is DISABLED - re-enable immediately' }
$sbl = Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -ErrorAction SilentlyContinue
if (-not $sbl -or $sbl.EnableScriptBlockLogging -ne 1) {
    Write-Warning 'PowerShell Script Block Logging not enabled - enable via GPO for ClickFix visibility'
}

Remediation

Cisco unpatched vulnerability:

  1. Immediately inventory all internet-facing Cisco devices. Pull the management interface off the public internet if it is exposed — there is almost never a legitimate reason for a Cisco web UI or API to be internet-reachable.
  2. Apply any vendor workaround documented in the advisory (typically ACL restrictions on management-plane traffic or disabling the vulnerable feature/service).
  3. Subscribe to the Cisco Security Advisories feed and set an internal SLA to patch within 72 hours of fixed-release availability. Track the advisory in your vulnerability management platform as a KEV-equivalent priority even before CISA listing.
  4. Hunt retrospectively: review device configs for unauthorized local accounts, unexpected crypto or aaa changes, and unknown files in flash — edge-device implants persist through reboots and are invisible to endpoint EDR.

AI agent RCE:

  1. Identify every AI agent framework in your environment (including shadow instances on developer workstations) and pin to the patched version per the upstream project's security advisory.
  2. Enforce egress filtering on agent workloads: an agent that only needs OpenAI/Anthropic API access has no business resolving arbitrary external hosts.
  3. Strip ambient credentials from agent execution contexts. Use short-lived, scoped tokens rather than long-lived cloud keys.
  4. Add agent process trees to your EDR policy explicitly — developer tooling exclusions are where this class of compromise hides.

ClickFix:

  1. User awareness: brief staff this month specifically on the 'Win+R paste' lure and fake CAPTCHA pages. This technique fails completely if users recognize it.
  2. Deploy the Sigma rule and KQL above; the explorer→script-engine chain is high-fidelity.
  3. Enable PowerShell Script Block Logging and AMSI integration across the fleet; consider blocking mshta.exe outbound network connections via Windows Defender Firewall or your EDR's network protection for roles that don't require it.
  4. Where feasible, disable clipboard-write access for untrusted sites via browser policy, and evaluate application control (WDAC/AppLocker) rules restricting user-context script engine execution.

Browser hijacks:

  1. Inventory installed extensions via your MDM/EDR; remove anything not on an approved list and enforce ExtensionInstallBlocklist with an allowlist model for high-risk user populations.
  2. Alert on policy-key changes (rule above) rather than trusting static baselines.
  3. Rotate session tokens for users on hijacked endpoints — cookie theft means password resets alone are insufficient.

The through-line this week is trust exploitation. Shrink the trusted paths — management interfaces, agent runtimes, the Run dialog, the extension store — and you shrink the attacker's options dramatically.

Related Resources

Security Arsenal Red Team Services AlertMonitor Platform Book a SOC Assessment pen-testing Intel Hub

penetration-testingred-teamoffensive-securityexploitvulnerability-researchclickfix-attackscisco-vulnerabilityai-agent-rcebrowser-hijackingsocial-engineering

Is your security operations ready?

Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.

Book a SOC AssessmentSee AlertMonitor in Action