ClickFix Attacks Evolve to Better Hide Malicious Payloads

1. Executive summary

ClickFix operators have changed the delivery stage of the technique: compromised websites now pre-fetch a script payload into the victim's browser cache disguised as a PNG file, and the fake CAPTCHA or browser-update page instructs the user to run it from cache rather than download it from a remote host. Microsoft Threat Intelligence reported the browser-cache variant; ReversingLabs describes the wider ClickFix ecosystem as industrialised and outpacing conventional antivirus and endpoint defences. No CVE is involved: the method skips exploits and vulnerabilities entirely and depends on the user opening the Windows Run dialog or macOS Terminal and pasting a command. The risk to EMEA financial services is that the initial access step leaves no remote download to detect, so proxy, DNS and download-inspection controls that would normally catch a first-stage fetch see nothing.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The material is a technique report with no named victim, no confirmed sector targeting and no exploited CVE, so no trigger fact here changes what a client must do under a named article. The technique is relevant to control design under DORA Art. 17 (ICT-related incident management process) and NIS2 Art. 21(2)(d) (supply chain security measures) only once a client has an actual incident or a compromised third-party site in its own estate; at that point the ordinary incident-management and reporting obligations apply on their own terms.

3. Technical analysis & attack chain

The confirmed steps, as reported:

1. A user visits a compromised website.
2. The site pre-fetches a script payload into the browser cache, disguised as a PNG file. This is the change from the typical ClickFix pattern, which downloads and executes a remote payload.
3. The page presents a fake CAPTCHA check, browser update notice, or meeting error, and instructs the visitor to open the Windows Run dialog or macOS Terminal.
4. The user pastes and runs the command, which executes the payload already sitting in the browser cache.

The technique skips exploits and vulnerabilities entirely. There is no CVE, no vulnerable component and no patch to apply. Initial access is the user's own execution of a pasted command, which is why the method is not stopped by vulnerability management and is poorly served by download inspection: in the browser-cache variant the payload is already on the endpoint before the command runs.

The disguise as a PNG matters for defenders. A file written to the browser cache with an image extension and image-looking content will not trip rules that key on executable downloads, and the subsequent execution is a local file run rather than a network fetch. Detection has to move to the command line and to process behaviour on the endpoint.

ClickFix first appeared in late 2023 and early 2024, and Proofpoint named the technique in mid-2024. ReversingLabs assesses that it has moved from a one-off social engineering trick into an industrialised attack ecosystem. That assessment is single-sourced to ReversingLabs via Help Net Security; treat the "industrialised ecosystem" framing as vendor assessment rather than a measured fact.

What the sources do not give: no malware family, no C2 infrastructure, no persistence mechanism, no privilege-escalation step, no lateral movement, no exfiltration detail, and no named victim or sector. The primary item states that DNS TXT records are also being used to hide payloads, but provides no mechanism, no record format and no example. That claim is single-sourced to Dark Reading and is not corroborated by the related sources; do not build detection around it until a technical write-up with record contents is available.

4. Mitigation & containment

P1 (within 24h)

• Block execution of scripts from browser cache paths at the EDR or application-control layer. On Windows, the browser cache sits under the user profile (%LOCALAPPDATA%\Google\Chrome\User Data\Default\Cache, %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache, and the equivalent Firefox profile cache directory). A script interpreter launched with a cache path as its argument is the signal to alert on and, where policy allows, block.
• Alert on and, if business tolerance permits, block mshta.exe, wscript.exe, cscript.exe, powershell.exe and cmd.exe spawned from a browser process, and on any Run-dialog execution (explorer.exe spawning an interpreter) on user endpoints.
• Push a user-facing notice: no legitimate CAPTCHA, browser update or meeting-error page requires a command to be pasted into Run or Terminal. This is the single control that defeats the technique, because the payload never executes without the paste.

P2 (within 72h)

• Add the browser-cache execution path and Run-dialog interpreter spawns to EDR detection rules and to the SOC's triage playbook, with a defined containment step (isolate host, capture the cache file, capture the pasted command from process telemetry).
• Restrict or monitor outbound DNS TXT queries from user endpoints. The Dark Reading claim about TXT-record payload hiding is unconfirmed, but TXT queries from workstations are rare in most financial-services estates and cheap to baseline.
• Review proxy and secure web gateway logging for the compromised-site referrer pattern: users arriving at a page that immediately instructs a paste. Where the gateway can rewrite or block, block the instruction page rather than the payload.

P3 (within 7 days)

• Tabletop the scenario with the SOC: a user has run a pasted command, the payload came from cache, and there is no download event to pivot on. Confirm the team can reconstruct the command line and recover the cache file.
• Add the technique to security-awareness content, replacing generic phishing modules with the specific Run-dialog and Terminal paste pattern.

No vendor fix exists for this item. There is no CVE and no patch. The controls above are the whole of the mitigation.

5. Indicators of compromise

No indicators of compromise available in the source material. The sources name no hashes, domains, IP addresses, file names, registry keys or command strings.

The sources describe observable behaviours rather than atomic indicators. Those are listed below and are not suitable for the copyable block.

Behavioural indicators

6. Detection

The sources give no file hashes, no command strings, no mutexes, no scheduled-task names and no registry keys. The only concrete artefacts are the browser cache paths and the interpreter binaries, which are generic Windows components rather than artefacts of this threat. A YARA rule built on those would match legitimate activity and is not emitted.

The behavioural pattern is detectable in process telemetry, so a Sigma rule is warranted.

title: ClickFix Browser Cache Payload Execution via Run Dialog or Terminal
id: 8f3c1a72-4d5e-4b91-9c2a-6e7f0d1b3a54
status: experimental
description: Detects a script interpreter launched from a browser cache path, consistent with the ClickFix browser-cache variant in which a payload disguised as a PNG is pre-fetched and then executed by the user via the Windows Run dialog or macOS Terminal.
author: Adverse Trace
date: 2026-10-06
references:

  - https://thehackernews.com/2026/10/clickfix-smuggles-payloads-through.html
  - https://www.darkreading.com/cyberattacks-data-breaches/clickfix-attacks-evolve-better-hide-malicious-payloads
logsource:
  category: process_creation
  product: windows
detection:
  selection_interpreter:
    Image|endswith:

      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\powershell.exe'
      - '\cmd.exe'
  selection_cache_path:
    CommandLine|contains:

      - '\AppData\Local\Google\Chrome\User Data\'
      - '\AppData\Local\Microsoft\Edge\User Data\'
      - '\AppData\Local\Mozilla\Firefox\Profiles\'
      - '\Cache\'
  condition: selection_interpreter and selection_cache_path
falsepositives:

  - Browser extensions or management tooling that legitimately invokes an interpreter against a profile path
level: high

For macOS, the equivalent signal is a shell spawned by Terminal with an argument pointing at a browser cache directory under ~/Library/Caches/. The sources do not give the macOS cache path, so no rule is written for it here.

7. Sources

• Dark Reading, ClickFix Attacks Evolve to Better Hide Malicious Payloads, https://www.darkreading.com/cyberattacks-data-breaches/clickfix-attacks-evolve-better-hide-malicious-payloads, 2026-10-06
• The Hacker News, ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits, https://thehackernews.com/2026/10/clickfix-smuggles-payloads-through.html, 2026-10
• Help Net Security, ClickFix is changing the economics of social engineering, https://www.helpnetsecurity.com/2026/07/15/clickfix-social-engineering-attacks-report/, 2026-07-15

8. Adverse Trace position

We assess this as a technique update rather than a new capability, and we are not raising severity on it. There is no CVE, no exploited vulnerability, no named victim and no confirmed EMEA financial-services targeting in the source material, so the item does not meet the bar for a sector-wide alert. The operational point is narrower and worth acting on: the browser-cache variant removes the remote download that most estates rely on to catch first-stage ClickFix, which means detection has to sit on the endpoint command line. The DNS TXT record claim in the primary item is single-sourced and technically undescribed; we will not issue detection guidance for it until a write-up with record contents is available. The ReversingLabs "industrialised ecosystem" assessment is likewise single-sourced and should be read as vendor framing. We will monitor for a technical report naming the payload family, the pasted command strings and any C2 infrastructure, and will issue a follow-up with atomic indicators if that material appears. Clients who want the browser-cache execution rule tuned to their own interpreter allow-list should contact their Adverse Trace analyst.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.