Hackers Enhance ClickFix Attack Using Cache Smuggling to Stealthily Download Malicious Files

Cybersecurity researchers have uncovered a sophisticated evolution of the ClickFix technique that uses browser cache smuggling to covertly place malicious files on target systems without traditional file downloads. The campaign, identified on 9 October 2025, targets enterprise users with fake Fortinet VPN Compliance Checker pages, leveraging Fortinet branding to appear legitimate.

Instead of downloading scripts from remote servers, attackers cache a disguised payload in the browser by exploiting the cache mechanism and a ZIP archive wrapped between specific delimiters, which is later extracted and executed from the local cache. When victims paste a crafted PowerShell command into Windows Explorer, only a harmless file path is visible, while the hidden script runs, allowing the infection to proceed entirely through cached content.

The technique also relies on obfuscated JavaScript that fetches data presented as a JPEG image to trigger the caching process, complicating detection by traditional security tools, according to Expel. Organisations should monitor browser cache access and restrict PowerShell usage where possible, and employ secure web gateways and DNS filtering to mitigate this evolving threat.