# ClickFix Browser Cache Smuggling — Social Engineering MaaS Toolkit Storing Malware Payloads in Browser Cache to Bypass EDR, Firewalls, and Download Alerts

> A new evolution of the ClickFix social engineering campaign leverages browser cache smuggling to stage malware payloads as benign-looking cached resources (PNG/JPG) before execution, bypassing EDR, firewalls, and download alerts. Victims are socially engineered via fake error messages to paste PowerShell commands that locate and execute already-cached payloads — requiring no fresh network connection at execution time. A builder toolkit with source code is sold on underground forums for $300 (advertised February 17, 2026), with custom template rewrites for $200, creating a low barrier to entry that drives rapid adoption risk for ransomware, infostealer, and RAT deployment.

- **Published:** 2026-02-21T12:00:00Z
- **Last reviewed:** 2026-02-21T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0127
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-clearfake-cache-smuggling-tl-2026-0127.webp?v=e1eadc0c (Threadlinqs threat intel: ClearFake ClickFix Cache Smuggling: Detection & IOCs (TL-2026-0127) — High severity, 15 IOCs, 9 detection rules.)
- **ID:** TL-2026-0127
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 15 (2 shown free below)

## Description

On February 17, 2026, Dark Web Informer identified a threat actor advertising a new ClickFix payload delivery method on underground forums that stores malware within browser cache to evade detection and bypass endpoint security. This represents a significant evolution of the ClickFix social engineering technique, which has been active since at least mid-2024 and has seen broad adoption across criminal and nation-state threat actors.

## Cache Smuggling Mechanics

The core innovation lies in using the browser's legitimate caching mechanism as a malware staging ground. The attack chain operates as follows:

### Phase 1: Passive Payload Delivery
1. Victim visits a compromised website or phishing page (e.g., fake Fortinet VPN checker, fake Chrome/Word error page)
2. The page includes an <img> tag or JavaScript fetch() call that loads a resource from an attacker-controlled server
3. The server responds with Content-Type: image/jpeg but the body contains a malicious payload (ZIP, EXE, DLL, or Exif-embedded executable in a valid JPEG)
4. The browser caches this 'image' locally in the standard cache directory (Chrome: %LOCALAPPDATA%\Google\Chrome\User Data\Default\Cache\Cache_Data\)

### Phase 2: Social Engineering Trigger
The page displays a fake error message (fake Chrome update, fake Word document error, fake captcha verification) prompting the victim to 'fix' the issue. Two variants exist:
- ClickFix: Victim copies a command and pastes it into Windows Run dialog (Win+R) or PowerShell
- FileFix: Victim pastes a padded command into the Windows Explorer address bar, where 139+ spaces hide the malicious PowerShell command behind an innocent-looking file path

### Phase 3: Local Execution
The pasted command (PowerShell) performs:
1. Copies cache files to a temporary directory (e.g., %LOCALAPPDATA%\FortiClient\compliance)
2. Uses regex to extract the payload from cached files: (?<=bTgQcBpv)(.*?)(?=mX6o0lBw) or 13371337(.*?)13371337
3. Optionally decrypts the extracted content
4. Unzips and executes the final payload

Critically, the execution phase requires no network connection — the payload is already on disk in the cache, bypassing firewalls, EDR network monitoring, and download alerting systems.

## Exif Smuggling Variant (Advanced)

A more sophisticated variant embeds the payload within a valid JPEG's Exif metadata (Image Description field, up to 64KB). The image renders normally in browsers and passes image header validation. Null-byte concealment hides the payload. Extraction treats the cache file as raw bytes — no Exif parsing needed, just regex marker extraction.

## FileFix Explorer Address Bar Variant

The FileFix variant exploits Windows Explorer's address bar behavior. A command padded with 139+ whitespace characters appears as an innocent-looking network path but actually executes: conhost.exe --headless powershell.exe -EncodedCommand [Base64]. This bypasses visual inspection by users who check the clipboard before pasting.

## Evasion Advantages

- No network from script: PowerShell reads from local disk, bypassing web request monitors and EDR network hooks
- Valid image headers: Cached files pass Content-Type checks and TLS inspection
- Cache files skipped by AV: Browser cache directories are frequently excluded from real-time AV scanning; payloads execute in-memory
- No download dialog: Browser caches the resource passively as part of normal page rendering
- Self-cleaning: Browser cache auto-purges, destroying forensic evidence

## Underground Market

The toolkit is sold as a Malware-as-a-Service (MaaS) offering:
- Builder + Source Code + Setup Instructions: $300
- Custom Template Rewrites: $200 per template
- Advertised on underground forums since February 16-17, 2026

## Observed Campaigns and Payloads

ClickFix cache smuggling has been observed delivering: NetSupport RAT, Latrodectus (successor to IcedID), Lumma Stealer, ransomware loaders, and various infostealers. Lure themes include: fake Fortinet VPN compliance checkers, fake Chrome update prompts, fake Microsoft Word error dialogs, fake CAPTCHA verifications, TikTok/YouTube fake activation pages.

## Affected Platforms

- Google Chrome (primary target — Cache_Data directory)
- Microsoft Edge (Chromium-based, similar cache structure)
- Mozilla Firefox (similar cache mechanisms, likely vulnerable)
- Microsoft Outlook (attachment preview auto-downloads Exif images — email vector)
- Windows (primary OS target — PowerShell/Explorer execution)

## ClickFix Evolution Timeline

ClickFix emerged in March 2024 when initial access broker TA571 launched campaigns targeting thousands of organizations with HTML attachments displaying fake Word errors. The technique was rapidly adopted by the ClearFake cluster, which compromised legitimate websites to display fake browser update overlays using Binance Smart Chain-hosted JavaScript (EtherHiding). By mid-2024, Proofpoint documented widespread proliferation across multiple threat actors.

In October 2024, Sekoia TDR uncovered 'The Phantom Meet' — a ClickFix cluster using fake Google Meet pages to distribute Stealc and Rhadamanthys on Windows and AMOS Stealer on macOS, attributed to the Slavic Nation Empire (SNE) and Scamquerteo traffers teams within the Marko Polo and CryptoLove cryptocurrency scam ecosystems.

In February 2025, Fortiguard Labs identified a ClickFix campaign deploying the Havoc open-source C2 framework via Microsoft SharePoint, abusing Microsoft Graph API for command-and-control communication — demonstrating how ClickFix has been adopted for advanced post-exploitation beyond simple infostealer delivery.

## Cache Smuggling: The February 2026 Innovation

The cache smuggling variant advertised in February 2026 represents a qualitative leap in ClickFix evasion. Prior ClickFix campaigns required a live network connection during PowerShell execution to download the payload — a detection opportunity for EDR systems monitoring web request hooks. Cache smuggling eliminates this window entirely: the malware is already on disk before the user interacts with the social engineering prompt. Combined with the MaaS availability ($300 builder + source) and custom template service ($200), this technique lowers the barrier for less sophisticated operators to deploy ransomware, infostealers, and RATs at scale.

## MITRE ATT&CK

- T1204.001 Malicious Link
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1566.002 Spearphishing Link
- T1189 Drive-by Compromise
- T1027 Obfuscated Files or Information
- T1027.009 Embedded Payloads
- T1036.005 Match Legitimate Resource Name or Location
- T1140 Deobfuscate/Decode Files or Information
- T1070.004 File Deletion
- T1564 Hide Artifacts
- T1553.005 Mark-of-the-Web Bypass
- T1547.001 Registry Run Keys / Startup Folder
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1005 Data from Local System
- T1115 Clipboard Data
- T1567 Exfiltration Over Web Service
- T1071.001 Web Protocols
- T1219 Remote Access Tools
- T1583.001 Domains
- T1587.001 Malware
- T1608.001 Upload Malware
- T1486 Data Encrypted for Impact
- T1569.002 Service Execution
- T1218.005 Mshta
- T1082 System Information Discovery
- T1497 Virtualization/Sandbox Evasion

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**ClickFix Cache Smuggling — PowerShell Spawned from Explorer via Run Dialog** (`TL-2026-0127-SPL-001`)

Detects the primary ClickFix exploitation chain where a user pastes a malicious PowerShell command into the Windows Run dialog (Win+R) or Explorer address bar. Catches explorer.exe spawning powershell.exe, the conhost.exe --headless variant, and the FileFix 139-space padding variant.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.001, T1059.001, T1059.003, T1189
- **Data sources:** sysmon, windows_security, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| search (ParentImage="*\\explorer.exe" AND (Image="*\\powershell.exe" OR Image="*\\cmd.exe" OR Image="*\\conhost.exe"))
    OR (Image="*\\conhost.exe" AND CommandLine="*--headless*")
    OR (ParentImage="*\\conhost.exe" AND Image="*\\powershell.exe")
| eval is_clickfix=if(match(CommandLine, "(?i)(Cache_Data|bTgQcBpv|mX6o0lBw|13371337|EncodedCommand|\-ep\s+bypass|\-w\s+hidden)"), "high", "medium")
| eval is_filefix=if(match(CommandLine, "^\s{50,}"), "yes", "no")
| eval is_conhost_headless=if(match(CommandLine, "(?i)conhost.*--headless"), "yes", "no")
| stats count values(CommandLine) as commands values(User) as users values(is_clickfix) as confidence values(is_filefix) as filefix_variant values(is_conhost_headless) as conhost_headless by Computer, ParentImage, Image
| where count > 0
| table Computer, users, ParentImage, Image, commands, confidence, filefix_variant, conhost_headless, count
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (InitiatingProcessFileName =~ "explorer.exe" and (FileName in~ ("powershell.exe", "cmd.exe", "conhost.exe")))
    or (FileName =~ "conhost.exe" and ProcessCommandLine has "--headless")
    or (InitiatingProcessFileName =~ "conhost.exe" and FileName =~ "powershell.exe")
| extend IsClickFix = ProcessCommandLine matches regex @"(?i)(Cache_Data|bTgQcBpv|mX6o0lBw|13371337|EncodedCommand)"
| extend IsFileFix = ProcessCommandLine matches regex @"^\s{50,}"
| extend IsConhostHeadless = ProcessCommandLine has "--headless"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, IsClickFix, IsFileFix, IsConhostHeadless
| sort by Timestamp desc
```

### Sigma

```yaml
title: ClickFix Cache Smuggling — PowerShell Spawned from Explorer via Run Dialog
id: a3f1c8d2-7e4b-4a91-b6c3-8d2f1a5e9c74
status: experimental
description: Detects ClickFix/FileFix social engineering where explorer.exe spawns PowerShell, cmd, or conhost with suspicious parameters indicating cache extraction or encoded command execution.
author: Threadlinqs Team
date: 2026/02/21
tags:
    - attack.execution
    - attack.t1204.001
    - attack.t1059.001
    - attack.t1059.003
    - attack.initial_access
    - attack.t1189
logsource:
    product: windows
    category: process_creation
detection:
    selection_explorer_parent:
        ParentImage|endswith: '\explorer.exe'
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\cmd.exe'
            - '\conhost.exe'
    selection_conhost_headless:
        Image|endswith: '\conhost.exe'
        CommandLine|contains: '--headless'
    selection_conhost_child:
        ParentImage|endswith: '\conhost.exe'
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    filter_legitimate:
        CommandLine|contains:
            - 'Get-AppxPackage'
            - 'Windows.SystemToast'
    condition: (selection_explorer_parent or selection_conhost_headless or selection_conhost_child) and not filter_legitimate
falsepositives:
    - Legitimate system administration scripts launched from Run dialog
    - Windows update mechanisms using explorer.exe as parent
    - Developer tools that launch PowerShell from Explorer context
level: high
```

**Known false positives:**

- Legitimate PowerShell scripts launched manually via Win+R by administrators
- Windows Explorer shell extensions that spawn cmd.exe

**Tuning notes:** Add CommandLine allowlist for approved admin scripts. conhost.exe --headless spawning PowerShell is almost always malicious — treat as high-fidelity.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- ClickFix Exploitation — Cache Directory Access by Script Interpreter (locked: unlock with TL Creds)
- ClickFix Post-Exploitation — Sandbox Evasion WMI Queries and HijackLoader DLL Sideloading (locked: unlock with TL Creds)
- ClickFix C2 — Clipboard Hijacker and High-Volume Outbound DDoSia Traffic (locked: unlock with TL Creds)
- ClickFix Exploitation — FileFix Whitespace-Padded Command Execution (locked: unlock with TL Creds)
- ClickFix Post-Exploitation — NetSupport RAT from Non-Standard Path and Registry Persistence (locked: unlock with TL Creds)
- ClickFix C2 — Content-Type Mismatch at Proxy and Known ClickFix Domain Indicators (locked: unlock with TL Creds)
- ClickFix Post-Exploitation — Browser Credential Store Access by Non-Browser Process (locked: unlock with TL Creds)
- ClickFix C2 — Graph API Abuse and Web Service Exfiltration (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 15)

Defanged, TLP:CLEAR.

- Domain: `fc-checker[.]dlccdn[.]com`
- Domain: `checker[.]dlccdn[.]com`

Full set of 15 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Threat Actors Advertising New ClickFix Payload That Stores Malware within Browser Cache](https://cybersecuritynews.com/threat-actors-advertising-new-clickfix-payload/)
- [Dark Web Informer — ClickFix Underground Forum Advertisement (Twitter/X)](https://x.com/DarkWebInformer/status/2023469095635632330)
- [Passively Downloading Malware Payloads via Browser Image Cache Smuggling — Blackswan Cybersecurity](https://www.linkedin.com/pulse/passively-downloading-malware-payloads-via-browser-image-saylor-iaxjc)
- [Proofpoint — Clipboard to Compromise: PowerShell Script Self-Pwn (TA571, ClearFake, ClickFix Origins)](https://www.proofpoint.com/us/blog/threat-insight/clipboard-compromise-powershell-self-pwn)
- [Sekoia TDR — ClickFix Tactic: The Phantom Meet (Fake Google Meet, SNE/Scamquerteo Traffers)](https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/)
- [BleepingComputer / Fortiguard — New ClickFix Attack Deploys Havoc C2 via Microsoft SharePoint](https://www.bleepingcomputer.com/news/security/new-clickfix-attack-deploys-havoc-c2-via-microsoft-sharepoint/)
- [ReliaQuest — New Execution Technique in ClearFake Campaign (Early ClickFix Documentation)](https://www.reliaquest.com/blog/new-execution-technique-in-clearfake-campaign/)
- [MITRE ATT&CK T1204 — User Execution](https://attack.mitre.org/techniques/T1204/)
- [MITRE ATT&CK T1059.001 — PowerShell](https://attack.mitre.org/techniques/T1059/001/)
- [MITRE ATT&CK T1027.009 — Embedded Payloads](https://attack.mitre.org/techniques/T1027/009/)
- [Guard.io — EtherHiding: Web3 Smart Contract Malware Distribution (ClearFake Infrastructure)](https://labs.guard.io/etherhiding-hiding-web2-malicious-code-in-web3-smart-contracts-65ea78efad16)
- [CISA — #StopRansomware: Understanding Ransomware Threat Actors (Social Engineering Delivery Vectors)](https://www.cisa.gov/stopransomware)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0127