Click Fix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits
Summary: Microsoft Threat Intelligence described a ClickFix variant in which compromised websites pre-fetch a script payload into the browser cache disguised as a PNG file, so the command a victim pastes into Windows Run executes content already on the device. The staged VBScript invokes cmd.exe to enumerate files beginning with "f_" in the browser profile folder, copies a size-matching cache entry to %LOCALAPPDATA%\Temp\t.vbs, and runs it with wscript.exe, bypassing the Run dialog's roughly 260-character input limit.
Bottom line: The payload never crosses the network at execution time, so defenses calibrated to download events see nothing, and CrowdStrike reported a 563% increase in fake-CAPTCHA incidents in 2025, with Stardust Chollima and Sandworm among the actors using the technique.
Read the original at The Hacker News ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026