ClickFix Social Engineering Attacks Evolve to Hide Payloads in Browser Caches

Hackers are using updated ClickFix attack techniques to hide malicious payloads in browser caches and domain name system text records, according to reports from Dark Reading, Cisco Talos, and The Hacker News. The revised tactics allow attackers to evade early detection and bypass standard Windows execution limits. [1][2][3][4]

The Hacker News reported that compromised websites trick users into executing malicious scripts that are pre-fetched directly into the browser cache. These scripts are frequently disguised as image files, such as PNG files, rather than downloading files using typical remote retrieval patterns. [3]

Microsoft observed ClickFix campaigns using browser cache smuggling to execute cached VBScript files, according to The Hacker News. This technique launches a malware chain designed to target user credentials. [3]

Dark Reading reported that attackers are also storing hidden payloads inside DNS TXT records and leveraging browser cache pre-fetching. These mechanisms make it significantly harder for security teams to identify the early stages of an attack chain. [1]