A new type of ClickFix attack is using compromised websites to trick users into executing a malicious payload cached in a web browser's cache.

"Instead of downloading and executing remote payloads like the typical attack pattern, in this attack, the websites pre-fetch a script payload into the browser cache disguised as a PNG file," the Microsoft Threat Intelligence team said in a post on X.

Thus, when the victim is prompted to paste and execute a malicious command -- as is the case with ClickFix attacks – it executes the cached website content that's already on the device.

What's notable about this browser cache smuggling approach is that it allows the attackers to conceal the payload script and bypass the character limit restrictions. The Windows Run dialog, triggered by Win + R, truncates any input that exceeds approximately 260 characters.

In the attack chain observed by Microsoft, the staged payload is a Visual Basic Script (VBScript), which then invokes "cmd.exe" to recursively enumerate files whose names start with "f_" in the browser's profile folder such as "%LOCALAPPDATA%\Mozilla\Firefox\Profiles."

"It compares each file's byte length with an expected value," Microsoft explained. "Rather than searching for a marker within the contents like previous attacks, it copies a size-matching cache entry to %LOCALAPPDATA%\Temp\t.vbs, giving the cached payload a VBScript extension, then executes it with wscript.exe. Copy output and errors are suppressed. The expected size varies across variants."

]com/alfa"), and then launch it. dat").

Source link