ClickFix smuggles payloads through browser cache to bypass Run restrictions
Start here
Microsoft Threat Intelligence disclosed a new type of ClickFix attack: infected websites prefetch script payloads disguised as PNGs into the browser cache, tricking users into pasting and executing commands that then run locally cached content, thereby bypassing the input truncation limit of about 260 characters in the Windows Run dialog. The payload is VBScript that enumerates files whose names start with "f_" in the browser configuration folder, matches by byte length, copies the cache entry as t.vbs, and executes it with wscript.exe, then uses PowerShell for multi-stage downloads of a .NET payload injection.
Generated by AI from reports · Updated 4 days ago
Progress timeline
- The Hacker NewsMicrosoft discloses a new ClickFix attack: hiding payloads in browser cache to bypass the Windows Run character limit
Microsoft Threat Intelligence disclosed a new type of ClickFix attack in which infected websites prefetch script payloads disguised as PNGs into the browser cache, tricking users into pasting and executing commands that then run locally cached content, thereby bypassing the input truncation limit of about 260 characters in the Windows Run dialog. The payload is VBScript that enumerates files whose names start with "f_" in the browser configuration folder, matches by byte length, copies the cache entry as t.vbs, and executes it with wscript.exe, then uses PowerShell for multi-stage downloads of a .NET payload injected into timeout.exe to steal browser and device credentials. Previously, in October 2025, there was a case of cache smuggling delivering ZIP files, and CloudSEK also demonstrated using invisible prompt injection and prompt overdose to make AI summarization systems generate ClickFix instructions.
Related discussion
Attention trend
New sources per day
- Oct 6New1 sources (1 outlets,0 accounts)
- Oct 7New0 sources (0 outlets,0 accounts)
- Oct 8New0 sources (0 outlets,0 accounts)
- Oct 9New0 sources (0 outlets,0 accounts)
- Oct 10New0 sources (0 outlets,0 accounts)
- Oct 11New0 sources (0 outlets,0 accounts)
- Oct 12New0 sources (0 outlets,0 accounts)
- Oct 13New0 sources (0 outlets,0 accounts)