New ‘ClickFix’ Malware Payload Targets Browser Cache, Warns Cybersecurity Experts
Threat actors have introduced a new "ClickFix" payload delivery method that conceals malware within the browser cache to avoid detection by endpoint detection and response (EDR) tools. This approach claims to execute malicious code via Windows File…
Threat actors have introduced a new "ClickFix" payload delivery method that conceals malware within the browser cache to avoid detection by endpoint detection and response (EDR) tools. This approach claims to execute malicious code via Windows File Explorer without generating noticeable network indicators.
The package on offer includes setup instructions, a builder ready for use, a lure template themed around Fortinet, and the full source code, priced at approximately 300 USD. For an additional 200 USD, the operator offers customization services for templates to align with a buyer's traffic requirements, such as Cloudflare-style captchas or VPN compliance themes.
This technique does not utilize the traditional Win+R ClickFix command chain. Instead, it relies on File Explorer address bar execution, presenting the attack as a benign file path operation. The method involves delivering payloads from the browser cache rather than downloading them over the network.
The technique builds on the cache smuggling method, where the browser is duped into caching a malicious file disguised as an innocuous asset. Upon visiting a phishing page, JavaScript compels the browser to retrieve a fake JPEG that contains an embedded archive or binary, which is then stored in the browser's cache path.
This approach claims to execute malicious code via Windows File Explorer without generating noticeable network indicators.
Subsequently, users are instructed to paste a command into the File Explorer address bar, which triggers a PowerShell script instead of opening a directory. This script copies cache files to a working folder, locates unique markers around the hidden payload, extracts the embedded ZIP or executable, and executes it locally, all without making new HTTP requests at the time of execution.
This "ClickFix via cache smuggling" technique exemplifies how social engineering can exploit legitimate browser and Windows features to bypass traditional security measures. Organizations are already encountering similar campaigns that rely on users copying commands into the Run dialog or terminals. This new method circumvents existing detection rules by leveraging File Explorer and browser cache, avoiding visible download activities.
Defenders should monitor for atypical use of File Explorer’s address bar to initiate PowerShell, headless conhost.exe instances, significant access to browser cache directories, and subsequent archive extraction and process creation in user space. Security teams are advised to enhance browser settings, conduct user awareness training, and adjust EDR/SIEM detections for cache-smuggling activities that link browser operations with suspicious local execution.
For further details, visit our Google News , LinkedIn , and X pages.
Based on reporting by GBHackers.