FileFix + Cache Smuggling: A New Evasion Combo

Cybersecurity researchers have uncovered FileFix combined with cache smuggling as a new evasion technique in phishing campaigns, designed to bypass security controls that monitor untrusted code’s internet access. The approach avoids typical network requests by extracting payloads from the browser’s cache, then uses JavaScript to deliver a PowerShell or MSHTA payload without triggering standard outbound connection alerts.

It builds on the ClickFix concept, where fake CAPTCHA prompts trick users into running harmful commands, but extends capacity by redirecting victims to paste commands into Windows Explorer’s address bar, increasing the allowable input to up to 2,048 characters. A campaign described in the piece masqueraded as a FortiClient Compliance Checker, with the attacker’s JavaScript fetching a fake JPEG that actually contained a ZIP archive with malware, which PowerShell later extracted from the browser cache.

The technique also employs Exif data smuggling in JPEGs, embedding encrypted payloads within metadata to evade detection while keeping images valid. According to GBHackers on Security, these developments threaten to defeat component-level protections and call for footage in cache directory monitoring and metadata-stripping controls.