Microsoft Flags a ClickFix Twist That Hides Malware in the Browser Cache

Here Is How Layered Defenses Help

ClickFix attacks don’t break into a computer. They talk the user into opening the door, usually with a fake CAPTCHA or error message that asks them to paste a “fix” into a Windows tool. Microsoft Threat Intelligence has now described a variant that hides the malicious script in the browser’s own cache before the victim is asked to do anything.

The attack chain, stage by stage

The setup. A compromised website quietly pre-fetches a script into the visitor’s browser cache, disguised as a PNG image file.
The lure. The visitor is prompted to paste and run a command, the classic ClickFix move. Because the payload is already sitting on the machine, the command can be short. That hides the real script and gets around the Windows Run dialog, which cuts off input longer than about 260 characters.
The hunt. In the chain Microsoft observed, a VBScript uses cmd.exe to search the browser’s profile folder, such as the Firefox profiles directory, for files whose names start with “f_”. It picks the one whose size matches an expected value, copies it to the Temp folder as a .vbs file and runs it with wscript.exe, hiding any output or errors.
The follow-on. That script gathers system information through WMI and pulls down a PowerShell script from an outside server, which leads to further downloads executed in a hidden window.
The goal. .NET code is loaded into memory and injected into a freshly started, legitimate Windows process (timeout.exe) to go after browser and device credentials, with more in-memory stages and outbound connections after that.

Payload staging in the browser cache isn’t brand new: Expel documented a similar technique in October 2025, later identified as a red team exercise by Intrinsec. But ClickFix itself keeps growing. CrowdStrike says incidents involving fake CAPTCHA lures rose 563% in 2025.

Ravie Lakshmanan detailed Microsoft’s findings and the wider ClickFix landscape at The Hacker News.

Why one defense isn’t enough

Each stage of this chain is a chance to stop it, and no single control covers them all. The products named below are examples only. Similar capabilities are available from many vendors, so choose what fits your environment.

Layer 1: Make the “fix” instantly suspicious

Microsoft’s own advice is simple: a CAPTCHA should never ask you to run code. Teach staff that any web page asking them to paste a command into Run, Terminal or PowerShell is an attack, full stop.

Layer 2: Block bad sites before the lure loads

Web and network protection, such as the cloud-delivered protection in Microsoft Defender or a comparable DNS or secure web gateway service, can stop connections to known malicious or compromised sites.

Layer 3: Control what can run

Application control, using tools like Windows Defender Application Control, AppLocker or an equivalent, can stop script hosts like wscript.exe from running files dropped in Temp, and can limit PowerShell for users who don’t need it.

Layer 4: Record what scripts actually do

Microsoft recommends PowerShell script-block logging. Combined with an endpoint detection and response tool, it gives you a record of in-memory activity that file-based scanning can miss.

Layer 5: Hunt for the traces

Microsoft suggests looking beyond downloads to suspicious browser activity, entries in the RunMRU registry key (which records commands typed into Run), WScript or PowerShell processes launched by unexpected parents, and new scheduled tasks.

Layer 6: Limit what stolen credentials can do

This attack targets saved browser and device credentials. Phishing-resistant MFA and conditional access mean a stolen password alone isn’t enough to sign in elsewhere.

What this means for your company

Users are the target, so train for this specific trick. A short demo of a fake CAPTCHA asking for Win+R is more memorable than a generic phishing slide.
Tighten script execution on everyday PCs. Most employees never need to run VBScript or PowerShell. Restricting them removes the attacker’s favorite tools.
Make sure someone is watching the logs. Logging only helps if alerts are reviewed, whether in-house or by a managed provider.

Need help putting layered protection in place against ClickFix and other social engineering attacks? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.