ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits

A new variant of the ClickFix attack technique has been identified, where compromised websites pre-fetch malicious script payloads into the browser cache, disguised as PNG files. Unlike traditional ClickFix attacks that download and execute remote payloads, this method leverages the browser cache to bypass Windows execution restrictions. The technique tricks users into executing the cached malicious payload. The attack was reported by Microsoft Threat Intelligence team. This represents an evolution in the ClickFix attack pattern, making detection and prevention more challenging by abusing legitimate browser caching mechanisms.