ClickFix Browser Cache Smuggling — Social Engineering MaaS Toolkit Storing Malware Payloads in Browser Cache to Bypass EDR, Firewalls, and Download Alerts
ClickFix Browser Cache Smuggling (TL-2026-0127), also tracked as ClickFix, is a high-severity malware campaign, first published 2026-02-21. It has no confirmed attribution, affects Google Chrome, maps to 28 MITRE ATT&CK techniques (T1005, T1027, T1027.009), and is covered by 9 detection rules and 15 indicators of compromise.
Key facts for TL-2026-0127
- Threat ID
- TL-2026-0127
- Also known as
- ClickFix, FileFix, FakeFix, ClearFake, Cache Smuggling, Browser Cache Malware Staging
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-02-21
- Last reviewed
- 2026-02-21
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- enterprise, financial, technology, healthcare, education, government, retail, critical-infrastructure
- Target regions
- Global, North America, Europe, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 15
Malware and tooling in ClickFix Browser Cache Smuggling
Malware and tooling: AMOS, Amadey, AsyncRAT, DarkGate, IcedID, Latrodectus, Lumma, Rhadamanthys, Stealc, Vidar, Cobalt Strike, Havoc
A new evolution of the ClickFix social engineering campaign leverages browser cache smuggling to stage malware payloads as benign-looking cached resources (PNG/JPG) before execution, bypassing EDR, firewalls, and download alerts. Victims are socially engineered via fake error messages to paste PowerShell commands that locate and execute already-cached payloads — requiring no fresh network connection at execution time. A builder toolkit with source code is sold on underground forums for $300 (advertised February 17, 2026), with custom template rewrites for $200, creating a low barrier to entry that drives rapid adoption risk for ransomware, infostealer, and RAT deployment.
How ClickFix Browser Cache Smuggling works
On February 17, 2026, Dark Web Informer identified a threat actor advertising a new ClickFix payload delivery method on underground forums that stores malware within browser cache to evade detection and bypass endpoint security. This represents a significant evolution of the ClickFix social engineering technique, which has been active since at least mid-2024 and has seen broad adoption across criminal and nation-state threat actors.
## Cache Smuggling Mechanics
The core innovation lies in using the browser's legitimate caching mechanism as a malware staging ground. The attack chain operates as follows:
### Phase 1: Passive Payload Delivery 1. Victim visits a compromised website or phishing page (e.g., fake Fortinet VPN checker, fake Chrome/Word error page) 2. The page includes an <img> tag or JavaScript fetch() call that loads a resource from an attacker-controlled server 3. The server responds with Content-Type: image/jpeg but the body contains a malicious payload (ZIP, EXE, DLL, or Exif-embedded executable in a valid JPEG) 4. The browser caches this 'image' locally in the standard cache directory (Chrome: %LOCALAPPDATA%\Google\Chrome\User Data\Default\Cache\Cache_Data\)
### Phase 2: Social Engineering Trigger The page displays a fake error message (fake Chrome update, fake Word document error, fake captcha verification) prompting the victim to 'fix' the issue. Two variants exist: - ClickFix: Victim copies a command and pastes it into Windows Run dialog (Win+R) or PowerShell - FileFix: Victim pastes a padded command into the Windows Explorer address bar, where 139+ spaces hide the malicious PowerShell command behind an innocent-looking file path
### Phase 3: Local Execution The pasted command (PowerShell) performs: 1. Copies cache files to a temporary directory (e.g., %LOCALAPPDATA%\FortiClient\compliance) 2. Uses regex to extract the payload from cached files: (?<=bTgQcBpv)(.*?)(?=mX6o0lBw) or 13371337(.*?)13371337 3. Optionally decrypts the extracted content 4. Unzips and executes the final payload
Critically, the execution phase requires no network connection — the payload is already on disk in the cache, bypassing firewalls, EDR network monitoring, and download alerting systems.
## Exif Smuggling Variant (Advanced)
A more sophisticated variant embeds the payload within a valid JPEG's Exif metadata (Image Description field, up to 64KB). The image renders normally in browsers and passes image header validation. Null-byte concealment hides the payload. Extraction treats the cache file as raw bytes — no Exif parsing needed, just regex marker extraction.
## FileFix Explorer Address Bar Variant
The FileFix variant exploits Windows Explorer's address bar behavior. A command padded with 139+ whitespace characters appears as an innocent-looking network path but actually executes: conhost.exe --headless powershell.exe -EncodedCommand [Base64]. This bypasses visual inspection by users who check the clipboard before pasting.
## Evasion Advantages
- No network from script: PowerShell reads from local disk, bypassing web request monitors and EDR network hooks - Valid image headers: Cached files pass Content-Type checks and TLS inspection - Cache files skipped by AV: Browser cache directories are frequently excluded from real-time AV scanning; payloads execute in-memory - No download dialog: Browser caches the resource passively as part of normal page rendering - Self-cleaning: Browser cache auto-purges, destroying forensic evidence
## Underground Market
The toolkit is sold as a Malware-as-a-Service (MaaS) offering: - Builder + Source Code + Setup Instructions: $300 - Custom Template Rewrites: $200 per template - Advertised on underground forums since February 16-17, 2026
## Observed Campaigns and Payloads
ClickFix cache smuggling has been observed delivering: NetSupport RAT, Latrodectus (successor to IcedID), Lumma Stealer, ransomware loaders, and various infostealers. Lure themes include: fake Fortinet VPN compliance checkers, fake Chrome update prompts, fake Microsoft Word error dialogs, fake CAPTCHA verifications, TikTok/YouTube fake activation pages.
## Affected Platforms
- Google Chrome (primary target — Cache_Data directory) - Microsoft Edge (Chromium-based, similar cache structure) - Mozilla Firefox (similar cache mechanisms, likely vulnerable) - Microsoft Outlook (attachment preview auto-downloads Exif images — email vector) - Windows (primary OS target — PowerShell/Explorer execution)
## ClickFix Evolution Timeline
ClickFix emerged in March 2024 when initial access broker TA571 launched campaigns targeting thousands of organizations with HTML attachments displaying fake Word errors. The technique was rapidly adopted by the ClearFake cluster, which compromised legitimate websites to display fake browser update overlays using Binance Smart Chain-hosted JavaScript (EtherHiding). By mid-2024, Proofpoint documented widespread proliferation across multiple threat actors.
In October 2024, Sekoia TDR uncovered 'The Phantom Meet' — a ClickFix cluster using fake Google Meet pages to distribute Stealc and Rhadamanthys on Windows and AMOS Stealer on macOS, attributed to the Slavic Nation Empire (SNE) and Scamquerteo traffers teams within the Marko Polo and CryptoLove cryptocurrency scam ecosystems.
In February 2025, Fortiguard Labs identified a ClickFix campaign deploying the Havoc open-source C2 framework via Microsoft SharePoint, abusing Microsoft Graph API for command-and-control communication — demonstrating how ClickFix has been adopted for advanced post-exploitation beyond simple infostealer delivery.
## Cache Smuggling: The February 2026 Innovation
The cache smuggling variant advertised in February 2026 represents a qualitative leap in ClickFix evasion. Prior ClickFix campaigns required a live network connection during PowerShell execution to download the payload — a detection opportunity for EDR systems monitoring web request hooks. Cache smuggling eliminates this window entirely: the malware is already on disk before the user interacts with the social engineering prompt. Combined with the MaaS availability ($300 builder + source) and custom template service ($200), this technique lowers the barrier for less sophisticated operators to deploy ransomware, infostealers, and RATs at scale.
MITRE ATT&CK techniques used in TL-2026-0127
collection
T1005 Data from Local System; T1115 Clipboard Data
defense-evasion
T1027 Obfuscated Files or Information; T1027.009 Embedded Payloads; T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1218.005 Mshta; T1497 Virtualization/Sandbox Evasion; T1564 Hide Artifacts
execution
T1059.001 PowerShell; T1059.003 Windows Command Shell; T1204.001 Malicious Link; T1569.002 Service Execution
command-and-control
T1071.001 Web Protocols; T1219 Remote Access Tools
discovery
T1082 System Information Discovery
initial-access
T1189 Drive-by Compromise; T1566.002 Spearphishing Link
impact
T1486 Data Encrypted for Impact
credential-access
T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers
persistence
T1547.001 Registry Run Keys / Startup Folder
defense-impairment
T1553.005 Mark-of-the-Web Bypass
exfiltration
T1567 Exfiltration Over Web Service
resource-development
T1583.001 Domains; T1587.001 Malware; T1608.001 Upload Malware
Affected products and versions in ClickFix Browser Cache Smuggling
- Google — Chrome
Vulnerable versions: All versions — abuses legitimate caching behavior - Microsoft — Edge
Vulnerable versions: All Chromium-based versions - Mozilla — Firefox
Vulnerable versions: All versions — similar cache mechanisms - Microsoft — Outlook
Vulnerable versions: All versions with automatic image preview - Microsoft — Windows
Vulnerable versions: Windows 10, Windows 11, Windows Server — PowerShell/Explorer execution
Remediation for ClickFix Browser Cache Smuggling
Patches
- No CVE patches — social engineering attack abusing legitimate browser caching functionality
- Keep browsers updated to latest versions for general security improvements
- Keep EDR signatures updated for known ClickFix payload families (Lumma, Latrodectus, NetSupport)
Immediate actions
- Train users to never paste commands from websites into PowerShell, Run dialog (Win+R), or Explorer address bar
- Block PowerShell processes that access browser cache directories via EDR behavioral rules
- Monitor for powershell.exe spawned as child of explorer.exe — strong indicator of ClickFix/FileFix execution
- Deploy browser extension BinHex Ninja or similar to block ClickFix clipboard manipulation
- Hunt for regex marker patterns in PowerShell command lines: bTgQcBpv, mX6o0lBw, 13371337
- Block known ClickFix domains at proxy/DNS level (fc-checker.dlccdn.com, checker.dlccdn.com)
- Scan browser cache directories for files with mismatched Content-Type vs actual file content
Workarounds
- Disable PowerShell for standard users via GPO where business requirements allow
- Block conhost.exe --headless execution via application control policies
- Restrict clipboard paste operations in elevated contexts via security tooling
- Implement DNS sinkholing for known ClickFix infrastructure domains
Longer-term hardening
- Implement AppLocker/WDAC policies constraining PowerShell execution to signed scripts only
- Deploy EDR rules monitoring cache directory access by script interpreters (PowerShell, cmd, wscript, cscript)
- Enable Constrained Language Mode for PowerShell via GPO for standard users
- Implement proxy-level Content-Type validation — block image/* responses containing ZIP/EXE/DLL signatures
- Disable Outlook automatic image preview for external emails
- Configure Sysmon to monitor process creation events (Event ID 1) for PowerShell with EncodedCommand parameters
- Monitor Windows RunMRU registry key for suspicious pasted commands
- Implement web filtering to block uncategorized/newly registered domains
- Enable Attack Surface Reduction (ASR) rules for Office and script execution
- Regular user awareness training on social engineering — specifically paste-this-fix lures
Weaknesses (CWE) in ClickFix Browser Cache Smuggling
CWE-451, CWE-345, CWE-494, CWE-116, CWE-829, CWE-434
Timeline of ClickFix Browser Cache Smuggling
- Guard.io publishes research on EtherHiding — ClearFake campaign using Binance Smart Chain contracts to host malicious JavaScript payloads on compromised websites. This infrastructure later underpins ClickFix delivery. Source: https://labs.guard.io/etherhiding-hiding-web2-malicious-code-in-web3-smart-contracts-65ea78efad16
- Proofpoint identifies initial access broker TA571 using clipboard-paste social engineering in email phishing campaigns (100,000+ messages). HTML attachments display fake Word errors prompting victims to paste PowerShell commands. Delivers DarkGate and Matanbuchus. Earliest documented ClickFix-style technique. Source: https://www.proofpoint.com/us/blog/threat-insight/clipboard-compromise-powershell-self-pwn
- ClearFake campaign adopts ClickFix technique — compromised websites display fake browser update errors prompting PowerShell paste. Uses Keitaro TDS for filtering and Binance Smart Chain for payload hosting. Delivers Lumma Stealer, Amadey, XMRig miner, and clipboard hijacker via HijackLoader.
- ClickFix variant 'ClickFix' discovered on compromised sites using iframe overlay at pley[.]es. Error message prompts PowerShell (Admin) paste, delivers Vidar Stealer. Activity cluster dubbed 'ClickFix' by researchers. ClearFake later subsumes the infrastructure.
- ReliaQuest publishes analysis of new ClearFake execution technique — the first public documentation of ClickFix-style social engineering as a distinct tactic. Multiple threat actors observed adopting the technique. Source: https://www.reliaquest.com/blog/new-execution-technique-in-clearfake-campaign/
- Proofpoint publishes comprehensive 'Clipboard to Compromise: PowerShell Script Self-Pwn' report documenting TA571 campaigns, ClearFake integration, and ClickFix proliferation across multiple threat actors delivering DarkGate, NetSupport RAT, and Matanbuchus.
- Sekoia TDR publishes 'ClickFix: The Phantom Meet' — fake Google Meet pages used to distribute Stealc and Rhadamanthys (Windows) and AMOS Stealer (macOS). Cluster attributed to Slavic Nation Empire (SNE) and Scamquerteo traffers teams. ClickFix technique now targeting both OS platforms. Source: https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/
- Fortiguard Labs discovers ClickFix campaign deploying Havoc C2 framework via Microsoft SharePoint. Phishing emails deliver HTML attachments with fake OneDrive errors. Python installer + Havoc DLL injection using Microsoft Graph API for C2 communication. Source: https://www.bleepingcomputer.com/news/security/new-clickfix-attack-deploys-havoc-c2-via-microsoft-sharepoint/
- Fortinet-themed ClickFix campaign observed using cache smuggling variant. Domain fc-checker.dlccdn.com mimics VPN compliance checker, delivers ZIP payload via fake JPG cached resource. First observed use of browser cache as malware staging ground.
- Exif smuggling variant proof-of-concept developed. Valid JPEG with malware payload embedded in Image Description Exif field (up to 64KB). Null-byte concealment evades casual inspection. Extends cache smuggling attack vector to email clients via Outlook automatic image preview.
- Threat actor advertises ClickFix cache smuggling builder on underground forums. Builder + source code + setup instructions for $300. Custom template rewrites for $200. Dark Web Informer documents the advertisement on X/Twitter. Source: https://x.com/DarkWebInformer/status/2023469095635632330
- Cyber Security News and Blackswan Cybersecurity publish technical analyses of the underground ClickFix cache smuggling toolkit. Blackswan details full attack chain: passive cache delivery via img tags, regex marker extraction, FileFix Explorer address bar variant with 139-space padding, and Exif null-byte concealment.
- Threadlinqs Intelligence publishes TL-2026-0127 with full analysis of ClickFix browser cache smuggling MaaS toolkit, detection coverage across SPL/KQL/Sigma, and simulation scenarios for endpoint validation.
- As of 2026-05-29, this ClickFix/FileFix cache-smuggling MaaS technique remains ACTIVE and escalating: Microsoft (May 6) reports evolving macOS campaigns, BleepingComputer/Expel confirm ransomware-gang adoption, and a May 26 campaign hijacked 700+ Ghost CMS sites via CVE-2026-26980. No CVE/patch applies (abuses legitimate caching) and the unattributed toolkit faces no takedown.
Sources cited for ClickFix Browser Cache Smuggling
- Threat Actors Advertising New ClickFix Payload That Stores Malware within Browser Cache
- Dark Web Informer — ClickFix Underground Forum Advertisement (Twitter/X)
- Passively Downloading Malware Payloads via Browser Image Cache Smuggling — Blackswan Cybersecurity
- Proofpoint — Clipboard to Compromise: PowerShell Script Self-Pwn (TA571, ClearFake, ClickFix Origins)
- Sekoia TDR — ClickFix Tactic: The Phantom Meet (Fake Google Meet, SNE/Scamquerteo Traffers)
- BleepingComputer / Fortiguard — New ClickFix Attack Deploys Havoc C2 via Microsoft SharePoint
- ReliaQuest — New Execution Technique in ClearFake Campaign (Early ClickFix Documentation)
- MITRE ATT&CK T1204 — User Execution
- MITRE ATT&CK T1059.001 — PowerShell
- MITRE ATT&CK T1027.009 — Embedded Payloads
- Guard.io — EtherHiding: Web3 Smart Contract Malware Distribution (ClearFake Infrastructure)
- CISA — #StopRansomware: Understanding Ransomware Threat Actors (Social Engineering Delivery Vectors)
More in malware
- Multi-Stage Cobalt Strike Loader Deploys Stageless Beacon via Anti-Sandbox .NET Chain
- Access-Code-Gated Phishing Chain Delivers Vidar Infostealer via DocuSign Impersonation
- ScarfaceStealer: Electron-Delivered Infostealer with Sandbox-Scoring Evasion and Smart-Contract C2
- Gigabud Android Banking Trojan Clones Banking Apps via Hidden Work Profile (Vwork/GoldFactory)
- LegionLoader Malware Distributed via Fake Cloudflare CAPTCHA Using the ClickFix Technique
Detection coverage for TL-2026-0127
As of 2026-02-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0127 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.