ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits

A new variation of the ClickFix attack has been discovered, which exploits compromised websites to deceive users into running malicious code stored in their web browser's cache. This attack differs from typical patterns as it does not involve downloading and executing remote payloads. Instead, the malicious payload is prefetched into the browser cache, disguised as a PNG file, allowing it to bypass Windows restrictions on running executable files. The Microsoft Threat Intelligence team has identified this tactic, highlighting a novel method used by attackers to evade security measures. This approach enables the attackers to smuggle payloads past typical defenses, posing a new challenge for threat detection. The use of a disguised PNG file as a delivery method adds a layer of complexity to