ClickFix Attack Variant Smuggles Payloads via Browser Cache to Evade Windows Execution Limits
A new ClickFix attack variant uses compromised websites to pre-fetch malicious payloads disguised as PNG files into the browser cache, bypassing Windows execution restrictions.
A novel variant of the ClickFix attack is employing compromised websites to deliver malicious payloads by cleverly utilizing the web browser's cache. Instead of the traditional method of directly downloading and executing remote scripts, this attack pre-fetches the payload, disguising it as a Portable Network Graphics (PNG) file.
This technique, identified by Microsoft Threat Intelligence, circumvents security measures designed to limit the execution of remote code on Windows systems. By storing the malicious script within the browser's cache, attackers avoid triggering alerts associated with direct script downloads or executions. The payload is then likely triggered through a separate mechanism, potentially a vulnerability in how the browser handles cached files or a user interaction that leads to the execution of the cached content.
The effectiveness of this method lies in its ability to blend in with normal web browsing activities. Users frequently visit websites that cache various types of content, including images. By masquerading the malicious script as a PNG, the attack exploits this trust and the browser's caching functionality to hide its true nature.
This approach represents a significant evolution in how ClickFix and similar malware families operate. Traditional ClickFix attacks often rely on social engineering to trick users into clicking malicious links that initiate downloads. This new variant shifts the focus to compromising legitimate websites, which then serve as the delivery mechanism for the cached payload, making detection more challenging for endpoint security solutions.
The implications of this attack vector are broad, potentially affecting any user browsing the internet through compromised websites. The bypass of Windows run limits means that even systems with robust endpoint detection and response (EDR) solutions might be vulnerable if the initial compromise and subsequent payload execution are not properly monitored.
Microsoft's advisory highlights the ongoing cat-and-mouse game between threat actors and defenders. As security measures become more sophisticated, attackers continuously adapt their tactics, techniques, and procedures (TTPs) to find new ways to infiltrate systems and execute their malicious code.
Further analysis is expected to reveal the exact methods used to trigger the execution of the cached payload and the full scope of affected systems. However, the core innovation lies in the exploitation of browser caching mechanisms as a covert channel for malware delivery, a tactic that could be adopted by other threat groups.
Users and organizations are advised to maintain vigilance regarding website security, ensure browsers and security software are up-to-date, and practice safe browsing habits to mitigate the risks associated with such evolving threats.