ClickFix hides its payload in the browser cache before the victim pastes anything
Microsoft documented a ClickFix variant that stages its payload in the browser cache, keeping the command the victim pastes under Windows' 260-character Run limit. Detection moves to script engines reading browser profile folders, not the pasted text.
The Watch · Security desk
What happened
- The cached VBScript invokes cmd.exe to recursively enumerate files whose names start with f_ inside the browser profile folder, Firefox's in Microsoft's example path.
- That script gathers host details through WMI, then fetches a PowerShell script named v.ps1 from cocojambo[.]us[.]com and launches it.
- The chain ends by loading .NET assemblies into memory and injecting code into a freshly launched timeout.exe process to steal browser and device credentials.
- Expel documented a cache-smuggling ClickFix chain in October 2025 that delivered a malware-laced ZIP, later identified as an Intrinsec red team engagement.
Why it matters
- What it limits constraint Caching the script conceals it and sidesteps the Run dialog's truncation, so a control that only inspects the pasted command string sees nothing worth blocking.
- Who's exposed exposure The pasted command only runs content the browser already fetched, so by the time a user acts the payload is on disk with no inbound download at execution time.
- What it sets up precedent Phishing kits such as IUAM already automate Fix-type lures, so a working cache step is positioned to spread into commodity campaigns.
Next story · Build · 9h ago
Zenity Labs: one prompt to a public AgentCore agent could return temporary credentials tied to a default role not scoped to that agentConfirmed3 publishers
Choosing which cached file to run is the step Microsoft flagged as new. "It compares each file's byte length with an expected value," Microsoft explained. It then "copies a size-matching cache entry to %LOCALAPPDATA%\Temp\t.vbs, giving the cached payload a VBScript extension, then executes it with wscript.exe." [7] Older cache-smuggling variants searched the file contents for a marker string. This one keys on byte length. The expected size changes between variants. [7]
"Instead of downloading and executing remote payloads like the typical attack pattern," the Microsoft Threat Intelligence team said, "in this attack, the websites pre-fetch a script payload into the browser cache disguised as a PNG file." [2]
The loader that follows pulls a stage named cab.dat and runs its contents in a hidden window. [9] The injected process then fetches a secondary in-memory stage from capsysnet[.]vg and opens outbound connections to ciliabula[.]cc. [11]
ClickFix has been one of the most-used social engineering methods for about two years. It is popular because it turns the victim into the channel that runs the malware, and it draws both cybercriminals and nation-state crews. [13]
The cache step is one branch of how the technique is mutating. In August 2025, CloudSEK published a proof-of-concept aimed at AI summarizers in email clients, browser extensions and productivity platforms, showing they could be steered into delivering ransomware through ClickFix. [15] Attackers hide the instructions in HTML with zero-width characters, white-on-white text and off-screen positioning. The text is invisible to a reader but parsed by the model. They also repeat the payload dozens of times, in a method CloudSEK calls prompt overdose, so it dominates the context window. [16] "When such crafted content is indexed, shared, or emailed, any automated summarization process that ingests it will produce summaries containing attacker-controlled ClickFix instructions," CloudSEK said. [17]
What to watch
- Whether Microsoft or others ship detection logic for cmd.exe and wscript.exe reading browser cache folders.
- Whether off-the-shelf kits like IUAM adopt the cache-staging step seen in bespoke chains.
- Follow-on reporting that ties cocojambo[.]us[.]com, capsysnet[.]vg and ciliabula[.]cc to a named operator.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+5
- Incentives30
- Confidence72
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
A new ClickFix attack uses compromised websites to trick users into executing a malicious payload that is cached in the web browser's cache.
- [2]
Instead of downloading and executing remote payloads like the typical attack pattern, in this attack, the websites pre-fetch a script payload into the browser cache disguised as a PNG file
- [3]
When the victim is prompted to paste and execute a malicious command, it executes the cached website content that is already on the device.
- [4]
The browser cache smuggling approach lets attackers conceal the payload script and bypass character limit restrictions.
- [5]
The Windows Run dialog, triggered by Win + R, truncates any input that exceeds approximately 260 characters.
- [6]
The staged payload is a VBScript that invokes cmd.exe to recursively enumerate files whose names start with 'f_' in the browser's profile folder, such as %LOCALAPPDATA%\Mozilla\Firefox\Profiles.
- [7]
It compares each file's byte length with an expected value. Rather than searching for a marker within the contents like previous attacks, it copies a size-matching cache entry to %LOCALAPPDATA%\Temp\t.vbs, giving the cached payload a VBScript extension, then executes it with wscript.exe. Copy output and errors are suppressed. The expected size varies across variants.
- [8]
The VBScript harvests host information via Windows Management Instrumentation, fetches a PowerShell script ('v.ps1') from an external server (cocojambo[.]us[.]com/alfa), and launches it.
- [9]
The v.ps1 PowerShell script is a conduit for an intermediate PowerShell payload that downloads the next stage ('cab.dat'), whose contents are then read and executed in a hidden window.
- [10]
The attack loads .NET assemblies into memory and injects code into a newly launched legitimate Windows process ('timeout.exe') to target browser and device credentials.
- [11]
The injected process launches PowerShell to obtain a secondary in-memory stage from capsysnet[.]vg and initiates outbound connections to ciliabula[.]cc.
- [12]
In October 2025, Expel documented a ClickFix attack chain that used cache smuggling to deliver a malware-laced ZIP archive; the activity was later identified as a red team engagement conducted by Intrinsec.
- [13]
ClickFix has become a very popular social engineering technique over the past two years, attractive as an initial access method for cybercriminals and nation-state actors because it turns the victim into a delivery channel for executing malware.
- [14]
Phishing kits like IUAM can automate the creation of 'Fix-type' attacks, and this commoditization has lowered the barrier to entry and accelerated the frequency of campaigns.
- [15]
In August 2025, CloudSEK released a proof-of-concept showing that AI summarization systems embedded in email clients, browser extensions, and productivity platforms can be weaponized to deliver ransomware via ClickFix.
- [16]
The payloads are embedded in HTML using CSS-based obfuscation such as zero-width characters, white-on-white text, and off-screen positioning that is invisible to humans but parsed by AI, and a method called prompt overdose repeats the payload dozens of times to dominate the model's context window.
- [17]
When such crafted content is indexed, shared, or emailed, any automated summarization process that ingests it will produce summaries containing attacker-controlled ClickFix instructions
Sources
2 independent publishers whose own reporting we read for this story.
- infosecurity-magazine.comClickFix Attack Hides VBScript Payload in Browser Cache
1 article · October 6, 2026
- thehackernews.comClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits
1 article · October 5, 2026
Topics and entities
Topics
- Browser cache smuggling
- ClickFix
- Credential-stealing malware
- Prompt injection