ClickFix attacks use browser cache to smuggle payloads

A recent ClickFix campaign is hiding malicious Visual Basic scripts disguised as image files in browser caches on victims' devices, according to Microsoft Threat Intelligence. Instead of downloading malware after tricking users into running a command, attackers now pre-load the payload into the browser cache. This method helps circumvent character limits in the Windows Run dialog and hides the script until execution. The VBScript ultimately enables theft of credentials and creates a persistent backdoor.

• Payload placed in cache as PNG, not downloaded later
• Run dialog command executes cached malware already on device
• VBScript gathers host info, runs further PowerShell scripts
• Attack persists via scheduled task using unpacked Python
• Microsoft recommends enhanced antivirus and logging settings