ClickFix hides its VBScript payload in the browser cache

ClickFix is a social engineering technique that is now very widespread: a fake verification step, usually a CAPTCHA, persuades the victim to paste and run a command prepared by the attacker. Microsoft Threat Intelligence has described a variant that makes the early stages of the attack harder to spot: the malicious script reaches the computer before the victim does anything, hidden in the browser cache and disguised as an image.

What happened

According to Infosecurity Magazine, Microsoft described the technique in a post on X on 3 October 2026. A cluster of compromised websites led visitors to the attack: a fake CAPTCHA pop-up asked them to open the Windows Run dialog, paste the contents of the clipboard and press Enter.

What is new is the order of operations. The payload is not downloaded after the victim acts: the site pre-loads it into the browser cache while the page is open. The pasted command only has to find and launch a file that is already on disk. According to Microsoft this serves two purposes: hiding the script and getting around the character limit of the Run dialog, which would not accept a long command.

The attack chain

The stages described by Microsoft, in order:

1. Command in the Run dialog: it starts cmd.exe, which searches the browser profile folder for cached files whose names begin with f_ and compares the size of each one with an expected value.
2. Matching by size: earlier attacks looked for a marker inside the cached content; this one recognises the right file by its size alone. It copies it to a temporary folder with a .vbs extension and runs it with wscript.exe.
3. Reconnaissance and second stage: the VBScript gathers system information through WMI, then fetches a PowerShell script and runs it with the execution policy bypassed.
4. In-memory code: later stages compile and load further code in memory and inject it into the legitimate timeout.exe process, to steal credentials from browsers and from the device.
5. Persistence: the malware connects to the attackers’ servers, unpacks a copy of Python with the built-in tar.exe tool and creates a scheduled task that runs a Python payload through pythonw.exe. The foothold therefore survives a reboot.

The available sources contain no domains, IP addresses or file hashes that could be used as indicators of compromise.

DNS TXT records too

Dark Reading places the campaign within a broader evolution of ClickFix: besides pre-loading into the browser cache, it reports the use of DNS TXT records to hide payloads, with the same aim of making the early stages of the attack less visible. The available sources give no technical details on this variant.

MITRE ATT&CK techniques

The stages described map to these techniques:

• User Execution: Malicious Copy and Paste (T1204.004), the command pasted by the victim;
• Command and Scripting Interpreter: Windows Command Shell (T1059.003), Visual Basic (T1059.005) and PowerShell (T1059.001);
• Windows Management Instrumentation (T1047), for reconnaissance;
• Process Injection (T1055), into the timeout.exe process;
• Credentials from Web Browsers (T1555.003);
• Scheduled Task (T1053.005), for persistence.

Impact for European and Italian companies

The technique does not exploit a software vulnerability: it exploits the user, who runs the command with their own permissions. That is why no update blocks it on its own. Pre-loading into the cache makes download-based controls less useful: the file arrives as an ordinary page resource and the pasted command contains no address to download from.

The final target is the credentials saved in browsers: access to email, business applications, cloud services and supplier portals. A single compromised computer can therefore open the way to other systems. For NIS2 entities, basic cyber hygiene and staff training are among the risk management measures; in healthcare, where workstations are often used to access portals holding patient data, credential theft from the browser has particularly sensitive consequences.

What to do now

1. Turn on the protections Microsoft recommends: cloud-delivered protection, network protection, application control and PowerShell script block logging. Microsoft Defender Antivirus detects the execution of the malicious commands as Trojan:Win32/ClickFix and Trojan:Win32/TermFix.
2. Hunt beyond downloads, as Microsoft suggests: browser activity, unusual executions of wscript.exe and PowerShell, new scheduled tasks and the RunMRU registry key (HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU), which records the commands typed into the Run dialog.
3. Check process chains: cmd.exe reading files in the browser cache, .vbs files in temporary folders, tar.exe unpacking archives, pythonw.exe started by a scheduled task.
4. Reduce the tools available: for users who do not need them, consider disabling the Run dialog and Windows Script Host through group policy, and use application control to restrict which interpreters can start.
5. Tell your staff with a simple message, the same as Microsoft’s: a CAPTCHA never asks you to run code. Anyone who sees such a request should close the page and alert IT.
6. If you find an affected computer, isolate it and treat the credentials saved in its browsers as compromised: they must be changed, starting with privileged accounts.

How ARXDOME helps

ARX Sentry collects logs and security events from computers and servers and groups them into families such as suspicious executions and persistence, with MITRE ATT&CK tactics in the SOC pages. With ARX Trace, analysts run collections and searches across multiple machines and review file changes, useful for looking for traces such as RunMRU entries or .vbs files in temporary folders. ARX Shield shows the protection status of every machine and lets you isolate a suspicious computer from the network.

Last updated: 6 October 2026