ClickFix Browser Cache Smuggling — Social Engineering MaaS Toolkit Storing Malware Payloads in Browser Cache to Bypass EDR, Firewalls, and Download Alerts — Threadlinqs Intelligence
As of 2026-05-30, ClickFix Browser Cache Smuggling — Social Engineering MaaS Toolkit Storing Malware Payloads in Browser Cache to Bypass EDR, Firewalls, and Download Alerts is a high-severity malware threat attributed to a N/A-nexus actor, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 15 indicators of compromise.
Threat ID: TL-2026-0127 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: N/A · FINANCIAL
A new evolution of the ClickFix social engineering campaign leverages browser cache smuggling to stage malware payloads as benign-looking cached resources (PNG/JPG) before execution, bypassing EDR,
On February 17, 2026, Dark Web Informer identified a threat actor advertising a new ClickFix payload delivery method on underground forums that stores malware within browser cache to evade detection and bypass endpoint security. This represents a significant evolution of the ClickFix social engineering technique, which has been active since at least mid-2024 and has seen broad adoption across criminal and nation-state threat actors.
## Cache Smuggling Mechanics
The core innovation lies in using the browser's legitimate caching mechanism as a malware staging ground. The attack chain operates as follows:
### Phase 1: Passive Payload Delivery
1. Victim visits a compromised website or phishing page (e.g., fake Fortinet VPN checker, fake Chrome/Word error page)
2. The page includes an <img> tag or JavaScript fetch() call that loads a resource from an attacker-controlled server
3. The server responds with Content-Type: image/jpeg but the body contains a malicious payload (ZIP, EXE, DLL, or Exif-embedded executable in a valid JPEG)
4. The browser caches this 'image' locally in the standard cache directory (Chrome: %LOCALAPPDATA%\Google\Chrome\User Data\Default\Cache\Cache_Data\)
### Phase 2: Social Engineering Trigger
The page displays a fake error message (fake Chrome update, fake Word document error, fake captcha verification) prompting the victim to 'fix' the issue. Two variants exist:
- ClickFix: Victim copies a command and pastes it into Windows Run dialog (Win+R) or PowerShell
- FileFix: Victim pastes a padded command into the Windows Explorer address bar, where 139+ spaces hide the malicious PowerShell command behind an innocent-looking file path
### Phase 3: Local Execution
The pasted command (PowerShell) performs:
1. Copies cache files to a temporary directory (e.g., %LOCALAPPDATA%\FortiClient\compliance)
2. Uses regex to extract the payload from cached files: (?<=bTgQcBpv)(.*?)(?=mX6o0lBw) or 13371337(.*?)13371337
3. Optionally decrypts the extracted content
4. Unzips and executes the final payload
Critically, the execution phase requires no network connection — the payload is already on disk in the cache, bypassing firewalls, EDR network monitoring, and download alerting systems.
## Exif Smuggling Variant (Advanced)
A more sophisticated variant embeds the payload within a valid JPEG's Exif metadata (Image Description field, up to 64KB). The image renders normally in browsers and passes image header validation. Null-byte concealment hides the payload. Extraction treats the cache file as raw bytes — no Exif parsing needed, just regex marker extraction.
## FileFix Explorer Address Bar Variant
The FileFix variant exploits Windows Explorer's address bar behavior. A command padded with 139+ whitespace characters appears as an innocent-looking network path but actually executes: conhost.exe --headless powershell.exe -EncodedCommand [Base64]. This bypasses visual inspection by users who check the clipboard before pasting.
## Evasion Advantages
- No network from script: PowerShell reads from local disk, bypassing web request monitors and EDR network hooks
- Valid image headers: Cached files pass Content-Type checks and TLS inspection
- Cache files skipped by AV: Browser cache directories are frequently excluded from real-time AV scanning; payloads execute in-memory
- No download dialog: Browser caches the resource passively as part of normal page rendering
- Self-cleaning: Browser cache auto-purges, destroying forensic evidence
## Underground Market
The toolkit is sold as a Malware-as-a-Service (MaaS) offering:
- Builder + Source Code + Setup Instructions: $300
- Custom Template Rewrites: $200 per template
- Advertised on underground forums since February 16-17, 2026
## Observed Campaigns and Payloads
ClickFix cache smuggling has been observed delivering: NetSupport RAT, Latrodectus (successor to IcedID), Lumma Stealer, ransomware loaders, and various infostealers. Lure themes include: fake Fortinet VPN compliance c
Weaknesses (CWE)
CWE-451, CWE-345, CWE-494, CWE-116, CWE-829, CWE-434
Target sectors: enterprise, financial, technology, healthcare, education, government, retail, critical-infrastructure
Target regions: Global, North America, Europe, Asia-Pacific
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 15 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1204.001, T1059.001, T1059.003, T1566.002, T1189, T1027, T1027.009, T1036.005, T1140, T1070.004