Hackers hide VBScript payloads in browser caches via fake CAPTCHAs

Compromised websites are using a novel ClickFix attack to trick users into executing malicious VBScript files pre-fetched into their browser cache. InfoSecurity Magazine and The Hacker News both report that Microsoft Threat Intelligence observed the social engineering campaign targeting web visitors. Microsoft posted details of the activity on X on October 3. [1][2]

ClickFix attacks use fake verification steps, such as a malicious CAPTCHA pop-up, to manipulate users into opening the Windows Run dialog, pasting clipboard content, and hitting Enter. InfoSecurity Magazine and The Hacker News report that this campaign pre-fetches a VBScript payload disguised as a PNG image file into the browser cache before prompting the user. This staging tactic allows attackers to bypass length limits in the Windows Run dialog. [1][2]

A web cache is a system implemented client-side or server-side to optimize web browsing by storing multimedia and files locally. In this attack chain, executing the cached script launches malware designed to target user credentials, according to The Hacker News. [2][7]