ClickFix Attack Variant Stages VBScript Payload Inside Browser Cache
ClickFix Attack Variant Stages VBScript Payload Inside Browser Cache
Microsoft Threat Intelligence has documented a ClickFix variant that pre-fetches a VBScript payload into the browser cache disguised as a PNG file, bypassing the Windows Run dialog character limit. Security and endpoint teams need to verify detection coverage against this multi-stage, cache-resident execution chain.
Microsoft Threat Intelligence documented a ClickFix variant that stages a VBScript payload in the browser cache rather than fetching it from a remote server at execution time. The compromised website pre-fetches the script disguised as a PNG file. When the victim pastes and executes a command in the Windows Run dialog, the command retrieves the already-cached content instead of downloading a remote payload.
The technique bypasses the Windows Run dialog character limit of approximately 260 characters by offloading the payload to the cache before execution.
The observed attack chain:
- The initial VBScript invokes
cmd.exeto enumerate files in the browser profile folder whose names start withf_(for example,%LOCALAPPDATA%\Mozilla\Firefox\Profiles). - It compares each file's byte length to an expected value, copies a size-matching cache entry to
%LOCALAPPDATA%\Temp\t.vbs, and executes it withwscript.exe. Copy output and errors are suppressed. The expected size varies across variants. - The VBScript collects host information via WMI, then fetches a PowerShell script (
v.ps1) from an external server (cocojambo[.]us[.]com/alfa). - That script downloads an intermediate payload (
cab.dat), reads its contents, and executes them in a hidden window. - .NET assemblies are loaded into memory and inject code into a newly launched
timeout.exeprocess, targeting browser and device credentials. - The injected process fetches a secondary in-memory stage from
capsysnet[.]vgand initiates outbound connections tociliabula[.]cc.
A similar browser cache staging technique was documented by Expel in October 2025 and was subsequently identified as a red team engagement conducted by Intrinsec.
The source does not specify which Windows versions, browser versions, or organizational profiles are affected. The attack targets users who can be socially engineered into pasting commands into the Windows Run dialog, PowerShell, or similar utilities. Credentials stored in browsers and on the device are explicitly named as targets. Nation-state actors (including Stardust Chollima/BlueNoroff and Sandworm) and cybercriminals are documented as using ClickFix techniques; this specific cache-staging variant is attributed to Microsoft Threat Intelligence's observations but the source does not attribute it to a named threat group.
The Microsoft Threat Intelligence post on X and this article are dated October 6, 2026. The source does not give a date for when this specific variant was first observed in the wild.
The source does not state licensing, platform, or configuration requirements for the attack or for the recommended mitigations.
- Review detections for VBScript execution originating from
%LOCALAPPDATA%\Temp\with filenames liket.vbs, and forwscript.exespawned with suppressed output. - Hunt RunMRU registry key entries for suspicious pasted commands, as Microsoft recommends.
- Check for
WScript.exeorPowerShell.exespawned as child processes of browsers orcmd.exein EDR telemetry. - Review scheduled task creation events that follow browser activity, as Microsoft recommends.
- Enable PowerShell script-block logging if not already active, as Microsoft recommends.
- Verify web and network protection policies cover the documented IOC domains (
cocojambo[.]us[.]com,capsysnet[.]vg,ciliabula[.]cc); add them to blocklists as appropriate. - Confirm application control policies restrict or alert on
wscript.exeexecuting.vbsfiles from%LOCALAPPDATA%\Temp\, consistent with Microsoft's recommendation for application control. - Consider user awareness messaging: Microsoft states explicitly that a CAPTCHA should not ask users to run code, and that pasting commands from verification prompts into Run, Terminal, or PowerShell should be treated as a potential initial access attempt.
- If WordPress is in scope, check for CVE-2026-6854 (documented as exploited to inject ClickFix lures into compromised sites) and apply available patches.
My read is that the cache-staging step is primarily an evasion mechanism against two specific controls: network-based payload detection (the payload is already on disk before execution begins) and the Windows Run dialog character limit (the short command just locates and renames the cached file rather than encoding a full payload). The byte-length matching approach, rather than a content marker, suggests the attacker controls the exact file the command targets by pre-sizing it, which makes static signature matching on the loader command itself less reliable. The multi-stage chain through timeout.exe process injection is consistent with living-off-the-land tradecraft designed to blend with legitimate Windows activity.
My recommendation is to prioritize behavioral detections over IOC-only blocking for this technique. The infrastructure domains will rotate; the behaviors, specifically VBScript dropped to %LOCALAPPDATA%\Temp\, wscript.exe execution with suppressed output, and PowerShell child processes of cmd.exe, are more durable detection anchors. I would also treat PowerShell script-block logging as a baseline requirement, not optional, given how central PowerShell is to every stage of this chain.
The source is a The Hacker News article dated October 6, 2026, drawing on a Microsoft Threat Intelligence X post and secondary reporting from CrowdStrike, CTM360, ReversingLabs, Expel, CloudSEK, Fortra, and Intrinsec; it covers the attack chain in detail but does not provide prevalence data, affected platform versions, or mitigation configuration specifics beyond Microsoft's general recommendations.