ClickFix Technique Exploits Browser Cache to Smuggle and Execute Malicious Payloads

According to Microsoft Threat Intelligence, a new iteration of the ClickFix attack method is being used by threat actors to deliver malicious payloads. Instead of the typical approach of downloading and executing remote scripts, compromised websites are pre-fetching script payloads into the browser cache. These payloads are disguised as PNG image files to evade detection.

The attack chain begins when a user visits a compromised website. The site leverages browser caching mechanisms to store a malicious script, masquerading as a PNG file, in the local cache. Subsequently, user interaction—such as executing a command—triggers the script to run from the cache rather than from a remote download location. This method effectively bypasses Windows Run limits and typical security controls that monitor remote payload downloads.

Microsoft notes that this technique represents a shift in ClickFix operations, focusing on local browser storage to achieve execution. The implications are significant for users of Windows operating systems and various web browsers, as visiting a single compromised site could lead to arbitrary code execution on the local machine.