ClickFix Attack Smuggles Malicious Payloads via Browser Cache to Bypass Windows Run Limits
What Happened — A new variant of the ClickFix technique leverages compromised websites to preload malicious JavaScript into a browser’s cache, disguising the payload as a PNG image. When the user later visits the site, the cached script is executed locally, sidestepping Windows’ “Run” restrictions that normally block direct download‑and‑execute attacks.
Why It Matters for Trust & Control Assurance
- Demonstrates a control gap where traditional download‑blocking policies miss malicious code hidden in legitimate cache entries.
- Highlights the need for continuous monitoring of endpoint execution logs and browser‑cache hygiene as part of an evidence‑driven control‑assurance program.
- Aligns with the control objective of secure execution and logging of software assets, which maps to multiple frameworks (e.g., NIST CSF, ISO 27001).
Who Is Affected – Any organization that allows employee web browsing on Windows workstations, especially sectors with high‑value data such as finance, healthcare, and SaaS providers.
Recommended Actions
- Enforce strict content‑type validation on browsers and block execution of cached scripts that do not match their declared MIME type.
- Deploy endpoint detection and response (EDR) rules to alert on anomalous cache‑based script execution.
- Incorporate cache‑integrity checks into your continuous control‑monitoring cadence and retain logs as audit evidence. Source: The Hacker News
Technical Notes – The technique exploits the Windows “Run” policy bypass by using the browser cache as a storage vector; no CVE is associated, but it relies on the ability to serve a PNG that the browser later treats as executable JavaScript. Source: Microsoft Threat Intelligence post on X