ClickFix Attack Hides Malware in Browser Cache to Bypass Windows Run Limits
Summary
Microsoft describes a ClickFix attack that stages a VBScript payload in browser cache to evade Windows Run’s input limit, then uses PowerShell and in-memory malware to target browser and device credentials.
Key points
- Compromised websites pre-fetch a script disguised as a PNG into the browser cache; victims are tricked into running a command that executes the cached payload.
- The VBScript locates a cache file by size, copies it as a .vbs file, and runs it, avoiding Windows Run’s roughly 260-character input limit.
- The infection chain gathers host information, downloads PowerShell stages, and ultimately loads .NET assemblies in memory that inject code into a legitimate Windows process.
- The attack aims to target browser and device credentials and uses additional external infrastructure for later stages.
- Other reported ClickFix campaigns have used compromised WordPress sites, fake CAPTCHA lures, and social engineering; some delivered Vidar Stealer or previously undocumented malware.
- Microsoft recommends cloud, web, and network protection, application control, PowerShell script-block logging, and hunting for suspicious browser activity and script processes.
- Users should not paste commands from CAPTCHA or troubleshooting prompts into Run, Terminal, or PowerShell.
Article Details
- Attack Vectors
- ClickFix lures prompt users to copy and execute attacker-supplied commands, including commands presented as CAPTCHA or troubleshooting steps.
- Compromised websites pre-fetch a script into the browser cache disguised as a PNG file; a user-executed command then locates and runs the cached payload.
- A VBScript fetches and launches a PowerShell script, which facilitates downloading a subsequent payload.
- In a campaign described by CTM360, attackers exploited CVE-2026-6854 in WordPress plugins to compromise websites and inject ClickFix lures; EtherHiding was used to retrieve the active lure hostname.
- CrowdStrike reported a campaign targeting an employee at a financial services entity with a bogus video conferencing site and a command that initiated a PowerShell- and VBScript-based chain delivering GeniexLoader and GeniexRAT.
- Sandworm was reported to have used ClickFix lures to trick suspected Ukrainian employees into running PowerShell commands that download a VBScript payload.
- Defensive Notes
- Microsoft recommends cloud-delivered, web, and network protection, application control, and PowerShell script-block logging.
- Hunt for suspicious browser activity, RunMRU registry key changes, WScript or PowerShell child processes, and scheduled tasks.
- Users should not paste commands from verification prompts into Run, Terminal, or PowerShell; a CAPTCHA should not ask users to run code.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | capsysnet[.]vg | Domain from which an injected process obtains a secondary in-memory stage. |
| DOMAIN | ciliabula[.]cc | Destination of outbound connections initiated by the injected process. |
| DOMAIN | cocojambo[.]us[.]com | Server domain from which the VBScript fetches a PowerShell script used in the attack chain. |
MITRE ATT&CK
T1055 · Process Injection.NET assemblies load into memory and inject code into a newly launched timeout.exe process.T1059.001 · PowerShellPowerShell commands and scripts download and launch payload stages.T1059.003 · Windows Command ShellThe staged VBScript invokes cmd.exe to enumerate browser-cache files.T1059.005 · Visual BasicThe attack executes VBScript payloads using wscript.exe.T1105 · Ingress Tool TransferPowerShell retrieves additional payload stages, including cab.dat and a secondary in-memory stage.T1204.004 · Malicious Copy and PasteClickFix lures instruct victims to copy and paste attacker-supplied commands.
CVE
Threat Actors
BlueNoroffIdentified in the article as an alternate name for Stardust Chollima.SandwormDescribed as a Russian state-sponsored adversary observed using ClickFix attacks against suspected Ukrainian employees.STARDUST CHOLLIMACrowdStrike reported this North Korea-aligned cluster likely targeted an employee at a financial services entity with a ClickFix campaign in July 2026.
Malware
GeniexLoaderThe command is designed to trigger a PowerShell- and VBScript-based infection chain that delivers two previously undocumented malware families dubbed GeniexLoader and GeniexRAT.GeniexRATThe command is designed to trigger a PowerShell- and VBScript-based infection chain that delivers two previously undocumented malware families dubbed GeniexLoader and GeniexRAT.Vidarwebsites have been identified as hosting fake pages, per CTM360, with the attack chains leading to Vidar Stealer.
Products
Microsoft Windowsit allows the attackers to conceal the payload script and bypass character limit restrictions imposed on Windows Run (aka the Run dialog). The Windows Run dialog, triggered by Win + R, truncates any input that exceedsMozilla FirefoxWordPressIn one campaign analyzed by CTM360, threat actors have been observed leveraging known vulnerabilities in WordPress plugins (e.g., CVE-2026-6854) to seize control of websites and inject ClickFix lures. The injected
Tools
Countries
Canadabeen observed targeting suspected Ukrainian employees working at organizations in France, the U.S., and Canada with ClickFix attacks to deceive them into running PowerShell commands that download a VBScript payload.Franceadversary has been observed targeting suspected Ukrainian employees working at organizations in France, the U.S., and Canada with ClickFix attacks to deceive them into running PowerShell commands thatNorth KoreaCrowdStrike, for its part, said it observed the North Korea-aligned Stardust Chollima (aka BlueNoroff) cluster likely targeting an employee at a financial services entity in July 2026 using a bogus video conferencingRussiaUkraineUnited States