New ClickFix Trick Hides Malware in Your Browser Cache

ClickFix Attacks Now Hide Malware in Your Browser Cache

Why the "quick fix" a website asks you to run could be the most dangerous thing you do online this year.

You land on a website and a CAPTCHA appears. Or a meeting link won't load, or a browser update asks for attention. A short instruction tells you to press a few keys and paste a command, and the problem is "fixed."

That is the ClickFix attack. Security researchers say it has a new twist: the malicious code is already sitting on your computer before you paste anything.

What Is a ClickFix Attack?

ClickFix is a social engineering technique. Instead of hacking into your device, the attacker persuades you to infect it yourself. Fortra's Bob Erdman put it this way: the attacker convinces you to open the door, and you do the rest.

It works because it asks you to use tools you already trust, such as the Windows Run box, PowerShell, or Terminal on a Mac. Nothing suspicious gets downloaded. There's no strange attachment and no unfamiliar installer.

A typical ClickFix attack goes like this:

1. The lure. You reach a fake or compromised website through a phishing email or a malicious ad.

2. The problem. The page shows a fake error, CAPTCHA, or browser update prompt.

3. The "solution." You're told to copy a command. Some pages use JavaScript to put it on your clipboard automatically.

4. The paste. You're asked to run it in Windows Run, PowerShell, Windows Terminal, or macOS Terminal.

5. The payload. The command pulls down more malware, and the attacker is in.

The New Twist: Browser Cache Smuggling

Microsoft Threat Intelligence has flagged a variant that changes the usual pattern. Normally the pasted command downloads a payload from a remote server. In this version, the compromised website quietly stores a script in your browser's cache, disguised as a harmless PNG image.

When you paste the command, it doesn't need to reach out to the internet. It finds the file that is already on your machine.

This helps attackers in two ways:

• It hides the payload. There's no obvious download for security tools to catch at that moment.

• It beats the character limit. The Windows Run dialog cuts off input at roughly 260 characters, which limits how much an attacker can paste. A cached payload sidesteps that, because the pasted command only has to locate and launch the file.

How the attack plays out on the device

According to Microsoft's analysis, the chain works roughly like this:

1. The pasted command searches the browser's profile folder for cache files whose names start with "f_".

2. It checks each file's size against an expected value. This is a different approach from earlier attacks, which searched file contents for a marker. The expected size differs between variants.

3. When it finds a match, it copies the file to a temporary folder and renames it with a VBScript extension, then runs it. Errors and output are suppressed, so you see nothing.

4. The script gathers information about the machine through Windows Management Instrumentation (WMI), then fetches and launches a PowerShell script from an external server.

5. That script leads to further stages. Eventually, .NET code is loaded into memory and injected into a legitimate Windows process (timeout.exe), which then goes after browser and device credentials.

The legitimate process is what makes this hard to spot. Malicious activity runs under the name of a normal Windows program.

This isn't the first time researchers have seen cache smuggling. Expel documented a similar technique in October 2025, though that activity was later identified as an authorized red team exercise by Intrinsec.

Why ClickFix Keeps Growing

ClickFix has become one of the most popular attack methods of the past two years, used by cybercriminals and nation-state groups alike. A few things explain why.

It feels routine. Employees deal with broken meetings, login prompts, CAPTCHAs, and browser errors all the time. CrowdStrike notes that being asked to do a quick troubleshooting step feels far less suspicious than receiving an unexpected attachment. Its data shows incidents involving fake CAPTCHA lures rose 563% in 2025.

It's easy to launch. Phishing kits such as IUAM automate the creation of these fake "fix" pages, which lowers the skill needed to run a campaign.

It evades traditional defenses. ReversingLabs said in a July 2026 report that ClickFix produces fewer of the malware signals older tools are tuned to catch. Campaigns also move quickly and rotate their infrastructure to avoid detection based on historic indicators.

ClickFix in the Wild: Recent Campaigns

• Compromised WordPress sites. CTM360 observed attackers exploiting vulnerable WordPress plugins (including CVE-2026-6854) to take over sites and inject ClickFix lures. The lure address is retrieved using EtherHiding, a technique that stores it on a blockchain, so attackers can rotate infrastructure without touching the hacked site. More than 3,000 compromised sites were found hosting fake pages, leading to Vidar Stealer infections.

• North Korea–aligned attackers. CrowdStrike linked a cluster known as Stardust Chollima (BlueNoroff) to an attempt in July 2026 against an employee at a financial services firm, using a fake video conferencing site. The chain delivered two previously undocumented malware families, GeniexLoader and GeniexRAT.

• Russia's Sandworm. The group was seen targeting suspected Ukrainian employees at organizations in France, the US, and Canada, likely using lures delivered through compromised Ukrainian websites. Victims were tricked into running PowerShell commands that download a VBScript payload.

• AI summary poisoning. In an August 2025 proof of concept, CloudSEK showed that AI summarizers in email clients, browser extensions, and productivity tools can be manipulated. Attackers hide instructions in a page using invisible text, then repeat them many times so they dominate the model's context. The resulting summary can contain attacker-written ClickFix instructions.

How to Protect Yourself and Your Team

For everyday users

• A CAPTCHA will never ask you to run code. If a website tells you to paste a command into Run, Terminal, or PowerShell, close the page.

• Treat any "fix" that involves the keyboard shortcut Win + R as a red flag.

• Don't paste anything you don't understand, even if it looks official.

• Keep your browser and plugins updated, especially if you run a WordPress site.

For security and IT teams

Microsoft recommends:

• Cloud-delivered, web, and network protection

• Application control

• PowerShell script-block logging

• Hunting beyond download events: look at suspicious browser activity, the RunMRU registry key, WScript and PowerShell child processes, and scheduled tasks

Also consider running awareness training that covers ClickFix specifically. Staff who have seen the pattern are much more likely to stop and report it.

Frequently Asked Questions

What is a ClickFix attack?
A social engineering attack where a fake error, CAPTCHA, or update prompt tricks you into pasting and running a malicious command yourself.

What is browser cache smuggling?
A technique where a compromised website stores a malicious script in your browser cache, disguised as an image, so the pasted command can run it locally instead of downloading it.

Why does the Windows Run dialog matter here?
It truncates input at around 260 characters. Caching the payload in advance lets attackers get around that limit.

Can antivirus stop ClickFix?
Not reliably on its own, since you launch the command yourself using trusted system tools. Layered defenses and user awareness matter most.

The Bottom Line

ClickFix succeeds because it doesn't look like an attack. It looks like help. The browser cache variant makes it stealthier still, since the dangerous file is already on your device by the time you're asked to run anything.

The rule is simple: no legitimate verification prompt will ever ask you to paste a command. If one does, stop, close the tab, and tell your IT or security team.