Microsoft Threat Intelligence has uncovered a ClickFix campaign in which compromised websites abuse browser cache storage to conceal malicious scripts and evade common detection techniques.
Rather than directly downloading a payload when the victim runs a command, the attackers pre-stage the malware in the browser cache, disguising it as a PNG image file.
The approach also addresses a practical limitation of ClickFix attacks: the restricted character length available in the Windows Run dialog.
Microsoft Warns of ClickFix Attacks Using Browser Cache
By placing the larger payload into the browser cache before the victim interacts with the fake prompt, attackers only need to trick the user into launching a relatively short command.
ClickFix is a social-engineering technique that persuades victims to manually execute attacker-provided commands. In this campaign, compromised sites display a fake verification or repair message that instructs users to open the Windows Run dialog, paste clipboard content, and press Enter.
The lure mimics CAPTCHA-style verification prompts, although legitimate CAPTCHA services do not require users to run commands on their own systems.
The injected webpage separates the malicious VBScript from the initial Run command. The command invokes cmd.exe to recursively enumerate files beginning with f_ in a browser profile directory, such as %LOCALAPPDATA%\Mozilla\Firefox\Profiles.
It then checks each file’s byte length against a hard-coded expected value. Instead of searching cached content for an embedded marker, as observed in earlier ClickFix activity, the malware identifies the cache file solely by its size.
A matching entry is copied to %LOCALAPPDATA%\Temp\t.vbs, effectively changing the cached file into a VBScript payload, and then launched through wscript.exe.
The command suppresses both output and errors, reducing visible indicators for the victim. Microsoft noted that the expected file size varies between campaign variants.
Once executed, the VBScript collects host details using Windows Management Instrumentation and retrieves a PowerShell script, v.ps1, from cocojambo[.]us[.]com/alfa.
It launches PowerShell with profile loading disabled and execution-policy restrictions bypassed. A later stage downloads an additional payload as cab.dat, reads its contents, and executes it in a hidden window.
The attack continues with .NET compilation activity involving csc.exe and cvtres.exe, followed by the execution of timeout.exe. Subsequent payloads load .NET assemblies directly into memory and inject code into timeout.exe, targeting browser-stored and device credentials.
The injected process then launches PowerShell to retrieve an additional memory-resident stage from capsysnet[.]vg and communicates with ciliabula[.]cc.
For persistence, the malware changes the per-user PowerShell configuration to apply a Bypass execution policy. It also uses tar.exe to unpack Python components and creates a scheduled task that launches a Python payload through pythonw.exe.
Microsoft said Defender provides layered coverage across this intrusion chain. Defender SmartScreen and Defender for Office 365 can help block malicious sites, links, attachments, and fake CAPTCHA lures, while Defender for Endpoint can generate alerts such as “Possible ClickFix activity.”
Defender Antivirus detects related behavior as Trojan:Win32/ClickFix and Trojan:Win32/TermFix. Security teams should enable cloud-delivered protection, web protection, network protection, application control, and PowerShell script-block logging.
Hunting should extend beyond downloads to browser activity, the RunMRU registry key, WScript and PowerShell child processes, and newly created scheduled tasks.
Any prompt telling a user to paste a command into Run, Terminal, or PowerShell should be treated as a likely initial-access attempt.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
