Zero-Download Malware: New Cache Smuggling Phishing Attack Delivers Payload via Browser Cache

SecurityOnline[.]info reports that Expel researchers have uncovered a new phishing campaign that blends social engineering with browser cache manipulation to install malware without downloading any files, impersonating a Fortinet VPN Compliance Checker. The operation began circulating in August 2025, promoted on X, with a phishing site hosted at fc-checker[.]dlccdn[.]com that mimicked Fortinet branding to target corporate users.

The campaign directs victims to copy and paste a command into Windows File Explorer, which copies a malicious PowerShell script that builds and executes malware from the browser’s cache. The PowerShell script avoids external downloads by searching for pre-staged data stored locally in the cache, where the attackers previously “smuggled” a payload. The malicious data is disguised as a .jpg file but contains a ZIP archive extracted from the browser cache and executed as FortiClientComplianceChecker.exe.

Expel notes that this cache-smuggling technique can evade many protections by delivering an entire ZIP payload without direct file downloads or web requests.