[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fvb7nX-FNDMf_71oNbxRgMGU2o5SJw0Y_vUU0mw0Ffo8":3},{"article":4,"iocs":47,"watch_terms":58,"solutions":59,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"e6121fe3-63df-44ec-bcc5-198d28fce3bc","ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits","clickfix-smuggles-payloads-through-browser-cache-to-bypass-windows-run-limits-fe8af1","A new type of ClickFix attack is using compromised websites to trick users into executing a malicious payload cached in a web browser's cache. \"Instead of downloading and executing remote payloads like the typical attack pattern, in this attack, the websites pre-fetch a script payload into the browser cache disguised as a PNG file,\" the Microsoft Threat Intelligence team said in a post on X.","A new variant of the ClickFix attack uses compromised websites to pre-fetch malicious script payloads into a user's browser cache, disguised as PNG files. This technique allows attackers to bypass Windows' character limits for the Run dialog and deliver VBScript and PowerShell payloads, ultimately aiming to steal credentials by injecting code into legitimate processes.","ClickFix attacks now smuggle payloads in browser cache to bypass Windows run limits.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fclickfix-smuggles-payloads-through.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEj8Vjgif5jASBMNSuYjBnVZcm9vGO378mJ7VTFTNo9HRROtViKbP_Nm0F0vf626be5n4cwnfDdqgfWVzjKrKboh0BnbM8ALWzt-W7kNq4PSc_TOUbNlwps6sCQgfNyK5DhXk3FHZCuJSo8D2eMOm4r89VmhNa6l5gPpadRZSgTuB_N2yPZlwj0voYddOoVr\u002Fs1600\u002Fclickfix.jpg","2026-10-06T05:22:55+00:00","2026-10-06T08:00:18.813745+00:00",8,[17,20,23,25,27],{"name":18,"type":19},"Windows","product",{"name":21,"type":22},"VBScript","technology",{"name":24,"type":22},"PowerShell",{"name":26,"type":22},"WMI",{"name":28,"type":22},"AI","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":29,"icon":31,"name":32,"slug":33},null,"Malware","malware",[35,40,42],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":41},{"id":29,"icon":31,"name":32,"slug":33},{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[48,52,55],{"type":49,"value":50,"context":51},"domain","cocojambo[.]us[.]com","External server for fetching PowerShell script",{"type":49,"value":53,"context":54},"capsysnet[.]vg","External server for secondary in-memory stage",{"type":49,"value":56,"context":57},"ciliabula[.]cc","Outbound connection destination",[18],{"controls":60,"vendors":145},[61,90,119],{"slug":62,"name":63,"problem":64,"products":65},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":91,"name":92,"problem":93,"products":94},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"slug":120,"name":121,"problem":122,"products":123},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[124,132,140],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":141,"product_name":142,"url":143,"description":144},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",[146],{"slug":75,"name":76,"logo_path":77,"roles":147},[148],"reported_by",{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":167},"clickfix-attack-abuses-browser-cache-to-smuggle-malicious-payloads","ClickFix Attack Abuses Browser Cache to Smuggle Malicious Payloads","The ClickFix attack variant exploits user trust by embedding malicious VBScript and PowerShell payloads inside files disguised as PNG images, pre-fetched into the browser cache via compromised websites. Attackers leverage this technique specifically to bypass Windows Run dialog character limits, a clever abuse of legitimate browser caching behavior that evades many traditional defenses. The ultimate goal is credential theft through process injection into trusted, legitimate Windows processes, making detection significantly harder. This attack succeeds largely because end users are socially engineered into initiating the execution chain, and because default browser and system configurations do not restrict these abuse vectors.",[154,155,156,157,158,159,160,161,162,163,164,165,166],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 9: Email and Web Browser Protections","CIS Control 10: Malware Defenses","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AC-3: Access Enforcement","NIST SP 800-53 AU-12: Audit Record Generation","NIST SP 800-53 SC-18: Mobile Code","MITRE ATT&CK T1059.001: PowerShell","MITRE ATT&CK T1055: Process Injection","MITRE ATT&CK T1204.002: User Execution – Malicious File","NIST CSF DE.CM-1: Network Monitoring","GDPR Article 32: Security of Processing (where credential data of EU subjects is at risk)",{}]