ClickFix Now Hides Its Payload in Your Browser Cache
You visit a website and a CAPTCHA or error message appears, telling you to press Win + R, paste a command and hit Enter. It feels like routine troubleshooting, but it is one of the most effective attack techniques of the last two years, and it just became stealthier.
What ClickFix is
ClickFix is a social engineering attack that does not exploit a software bug. Instead, the attacker convinces you to run the malicious command yourself. A victim is led to a fake or compromised website through phishing or malicious ads, shown a fake problem such as a CAPTCHA or browser update, and told to copy and paste a “fix” into Windows Run, PowerShell or Terminal. That command then pulls in more malware. As one Fortra researcher put it, the attacker doesn’t break in, they persuade you to open the door.
The new twist: cache smuggling
Microsoft Threat Intelligence recently described a variant that changes how the payload arrives. Normally the pasted command downloads the malware, but here the compromised website quietly pre-loads a script into the browser cache, disguised as a PNG image. When the victim pastes the command, nothing is downloaded. The command simply finds the file already on the machine and runs it.
This helps the attacker in two ways. There is no obvious download at the moment of execution, so fewer alarms go off. It also gets around the Windows Run dialog, which cuts off input longer than about 260 characters, because a short command that locates a cached file easily fits within that limit.
What happens after that
According to Microsoft, the cached file is a VBScript that is copied out of the browser profile folder and executed. It gathers information about the computer and fetches a PowerShell script, which downloads further stages. In the end, .NET code loads directly into memory and injects itself into a legitimate Windows process, aiming to steal browser and device credentials. Running in memory and inside trusted processes makes the later stages much harder for traditional antivirus to detect.
A trend, not a one-off
ClickFix has grown quickly. CrowdStrike reported a 563% rise in fake-CAPTCHA incidents in 2025, and CTM360 found more than 3,000 hijacked websites serving ClickFix pages that lead to Vidar Stealer, many of them compromised through WordPress plugin flaws. Nation-state groups use it too: CrowdStrike linked the North Korea-aligned Stardust Chollima to a lure on a fake video-conferencing site, and Russia’s Sandworm has used it against Ukrainian employees at organizations abroad. Researchers at CloudSEK have even shown that hidden text could trick AI summarizers into repeating ClickFix instructions. Ready-made phishing kits make all of this easier to run at scale.
Why it keeps working
People deal with broken meetings, login prompts and CAPTCHAs every day, so a quick troubleshooting step feels far less suspicious than an unknown attachment. The attack also relies on tools people already trust, such as Run and PowerShell, so there is no strange program to raise doubts.
How to protect yourself
The simplest rule is that a CAPTCHA never needs you to run code, so if a website asks you to paste a command into Run, PowerShell or Terminal, close it. Keep your browser and operating system updated and use reputable endpoint protection. Organizations should follow Microsoft’s advice: use cloud-delivered and network protection, apply application control, enable PowerShell script-block logging, and hunt for suspicious script processes and scheduled tasks rather than only watching downloads. Training staff to treat these prompts as possible attacks matters just as much.
Final thoughts
The most dangerous attacks are not always technically brilliant. ClickFix works because it turns the user into the delivery mechanism, and cache smuggling makes it harder to catch. One habit defeats all of it: never paste commands from a website into your system.
Reference
Comments