Microsoft discloses a new ClickFix attack: hiding payloads in browser cache to bypass the Windows Run character limit

Microsoft Threat Intelligence disclosed a new type of ClickFix attack in which infected websites prefetch script payloads disguised as PNGs into the browser cache, tricking users into pasting and executing commands that then run locally cached content, thereby bypassing the input truncation limit of about 260 characters in the Windows Run dialog. The payload is VBScript that enumerates files whose names start with "f_" in the browser configuration folder, matches by byte length, copies the cache entry as t.vbs, and executes it with wscript.exe, then uses PowerShell for multi-stage downloads of a .NET payload injected into timeout.exe to steal browser and device credentials. Previously, in October 2025, there was a case of cache smuggling delivering ZIP files, and CloudSEK also demonstrated using invisible prompt injection and prompt overdose to make AI summarization systems generate ClickFix instructions.