Skip to content
NewA calmer, faster ZeroHour
StoryPhishing & fraudmediumExploited in the wild

Microsoft Details ClickFix Browser-Cache Payload Attacks

2 sources · 2 articlesFirst reported Updated ()2 · 1 read
What's new

First coverage.

Merged summary · grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Microsoft says ClickFix campaigns hide VBScript in browser caches so short Run commands can launch credential-stealing malware.

Microsoft Threat Intelligence described ClickFix activity on compromised websites that prefetches a VBScript payload into the browser cache, disguised as an image, then uses a fake CAPTCHA to get victims to paste a short command into the Windows Run dialog. The Hacker News says the file is disguised as a PNG and that the script finds a size-matched Firefox cache entry; Infosecurity Magazine says cmd.exe matches cached files by name prefix and size, copies one as a .vbs file, and launches it with wscript.exe. Both reports say later stages run PowerShell and inject code into timeout.exe to steal credentials. Infosecurity adds that the script collects host details via WMI, that attackers unpack Python with tar.exe and persist through a scheduled task running pythonw.exe, and that Microsoft Defender detects the activity as Trojan:Win32/ClickFix and Trojan:Win32/TermFix. The Hacker News also says the cache technique bypasses the Run dialog’s roughly 260-character limit, cites a 2025 CloudSEK proof of concept that hid ClickFix steps in AI summaries, and notes CrowdStrike’s finding that fake-CAPTCHA incidents rose 563% in 2025.

Key facts
  • Microsoft Threat Intelligence described ClickFix activity that prefetches a VBScript payload into the browser cache; The Hacker News says it is disguised as a PNG, while Infosecurity Magazine says it is disguised as an image.
  • The Hacker News says the cached payload bypasses the Windows Run dialog’s roughly 260-character limit; victims are prompted, via a fake CAPTCHA on compromised sites, to paste a short Run command.
  • Sources disagree on retrieval: The Hacker News says the script finds a size-matched Firefox cache entry and runs it with wscript.exe; Infosecurity says cmd.exe matches cached files by name prefix and size, copies one as a .vbs, and…
  • Both reports say later stages run PowerShell and inject code into timeout.exe to steal credentials; Infosecurity adds WMI host collection, an execution-policy bypass, and theft of browser and device credentials.
  • Infosecurity Magazine reports persistence by unpacking Python with tar.exe and a scheduled task that runs pythonw.exe.
  • Microsoft Defender detects the activity as Trojan:Win32/ClickFix and Trojan:Win32/TermFix.
  • The Hacker News cites CrowdStrike’s finding that fake-CAPTCHA ClickFix incidents rose 563% in 2025 and a 2025 CloudSEK proof of concept that hid ClickFix steps in AI summaries.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Vendors
MicrosoftMozilla
Products
FirefoxWindowsPowerShellMicrosoft Defender Antivirus
Malware
ClickFixTrojan:Win32/ClickFixTrojan:Win32/TermFix
Organizations
MicrosoftExpelIntrinsecCloudSEKCrowdStrike

Coverage

oldest first · one row per article · UTC
  1. · 24d ago The Hacker NewsFirst report

    ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits

    Microsoft says ClickFix attacks now smuggle VBScript through the browser cache to bypass Windows Run limits.

  2. · 24d ago Infosecurity Magazine

    ClickFix Attack Hides VBScript Payload in Browser Cache

    Microsoft says a ClickFix campaign cached a VBScript payload as an image, then tricked users into launching it.