Hackers Upgraded ClickFix Attack With Cache Smuggling to Secretly Download Malicious Files
Cybersecurity researchers have identified an advanced iteration of the ClickFix attack, utilizing cache smuggling techniques to evade detection by traditional file download security mechanisms.
Cybersecurity researchers have identified an advanced iteration of the ClickFix attack, utilizing cache smuggling techniques to evade detection by traditional file download security mechanisms.
The campaign targets enterprise networks by impersonating a Fortinet VPN compliance checking tool, exploiting the trust placed in remote access infrastructure.
A malicious webpage hosted on the domain fc-checker[.]dlccdn[.]com mimics a legitimate corporate security utility designed to verify VPN compliance across enterprise environments.
This attack deviates from traditional ClickFix variants by storing malicious payloads within the browser's cache system, bypassing many security controls monitoring file downloads and network communications.
Expel analysts have highlighted this technique as an advancement in social engineering tactics, particularly as it targets Fortinet VPN clients used by enterprises for secure remote access.
The campaign is particularly dangerous due to its ability to mimic legitimate corporate network file executions.
The campaign is particularly dangerous due to its ability to mimic legitimate corporate network file executions.
The webpage displays a text box with an apparent standard network file path: "\\Public\Support\VPN\ForticlientCompliance.exe". However, it conceals a PowerShell payload designed to execute malicious code from the browser's cache without establishing external network connections.
The attack's sophistication lies in its cache smuggling technique, representing a novel approach to payload delivery.
When interacting with the malicious webpage, an obfuscated JavaScript function executes a fetch request to "/5b900a00-71e9-45cf-acc0-d872e1d6cdaa", presenting as a JPEG image by setting the HTTP Content-Type header to "image/jpeg".
The browser caches this file, but it contains no JPEG header, housing a compressed ZIP archive delimited by "bTgQcBpv" and "mX6o0lBw".
The PowerShell script within the clipboard payload includes a regex pattern that searches Chrome's cache for these delimiters: $m=[regex]::Matches($c,'(?<=bTgQcBpv)(.*?)(?=mX6o0lBw)',16) .
Once found, the script writes the data to "ComplianceChecker.zip", extracts the archive, and executes "FortiClientComplianceChecker.exe" offline.
This method circumvents security solutions monitoring file downloads or PowerShell web requests, as no explicit network activity occurs during execution.
Based on reporting by Cyber Security News.