ClickFix attackers hide executable scripts in browser cache

Microsoft Threat Intelligence has identified a ClickFix attack that stages a malicious script in a browser's cache disguised as a PNG image. Compromised websites then persuade users to run a command that executes the cached content, concealing the script and bypassing the Windows Run dialog's approximately 260-character input limit. The observed chain locates a cache file by its byte length, copies it with a Visual Basic Script extension and executes it. Subsequent stages load code into memory and inject it into a legitimate Windows process to target browser and device credentials. The attack still depends on a user pasting and executing the malicious command.