Plan
active
ClickFix variant smuggles payloads via browser cache to evade Windows Run limits
- Engineer — Learn: Novel delivery variant pre-fetches script payloads into browser cache disguised as image files, bypassing endpoint execution controls — no patch exists, but worth reviewing endpoint script-execution policies and browser isolation configurations.
- SOC/IR — Plan: New evasion technique shifts ClickFix from remote download to cache-resident payload execution; build or tune detections for unexpected script execution originating from browser cache directories, and hunt for suspicious PNG-typed files in cache that match script signatures.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.