TL-2026-0127 HIGH 2026-02-22 Threat Analysis

ClickFix Browser Cache Smuggling — EDR Bypass via MaaS Toolkit

Threadlinqs Intelligence 7 min
clickfixbrowser-cache-smugglingmaasedr-bypasspowershellsocial-engineeringlatrodectuslumma-stealernetsupport-ratinfostealer

Threat ID: TL-2026-0127 | Severity: HIGH | Status: ACTIVE

Actor: Unknown (MaaS toolkit seller) | Motivation: FINANCIAL

MITRE Techniques: 28 | Detections: 9 | CWEs: CWE-451, CWE-345, CWE-494, CWE-116, CWE-829

Browser cache was never meant to be a malware staging ground. ClickFix turned it into one.

A new evolution of the ClickFix social engineering chain eliminates the network detection window entirely by staging malware payloads in the browser cache before execution. Advertised on underground forums for $300 on February 16, 2026, the toolkit disguises executable payloads as cached image resources (PNG/JPG), then uses social engineering lures to trick victims into pasting PowerShell commands that extract and execute the cached payloads locally — bypassing EDR, firewalls, and download monitoring. What follows is a full breakdown of the cache smuggling mechanism, the ClickFix lineage from ClearFake through the current MaaS offering, and production-ready detection queries targeting each stage of the kill chain.

CyberMaxx/BlackSwan research on browser cache smuggling — documenting the download cradle technique that abuses browser image caching for payload staging. CyberMaxx/BlackSwan research on browser cache smuggling — documenting the download cradle technique that abuses browser image caching for payload staging.

Executive Summary

Technical Analysis

Cache Me If You Can

Cache as attack surface. Nobody saw it coming.

Traditional ClickFix campaigns required victims to paste PowerShell commands that downloaded malware over the network — a detectable event for EDR, proxy logs, and firewall rules. The cache smuggling variant removes this detection surface entirely by pre-staging payloads in the browser's local cache directory during the initial page visit. The stage-2 drops from cache, not from the network.

Phase 1 — Passive Delivery. When a victim visits a compromised or attacker-controlled website, the page loads malicious payloads disguised as image resources through standard tags or fetch() API calls. The server responds with Content-Type: image/jpeg headers while the response body contains executable code, compressed archives, or Exif-embedded payloads. Browser caching directives (Cache-Control: max-age=86400) ensure the payload persists locally.

Phase 2 — Social Engineering. The page displays a fake error dialog — Chrome update required, Microsoft Word rendering error, CAPTCHA verification, or Fortinet VPN compliance check. The lure instructs the victim to "fix" the issue by copying a command and pasting it into the Windows Run dialog (Win+R), PowerShell, or the Windows Explorer address bar.

Phase 3 — Local Execution. The pasted command invokes PowerShell to read from local browser cache directories, extract the payload using regex markers (bTgQcBpv, mX6o0lBw, or 13371337), optionally decrypt and decompress the content, then execute it. No callback. No download. The implant is already on disk, and EDR never sees a network fetch at execution time.

The FileFix Variant

A parallel variant called FileFix pads commands with 139 or more leading whitespace characters before the malicious PowerShell string. When pasted into the Windows Explorer address bar, the whitespace hides the actual command from view, making it appear the user navigated to a folder path. Execution occurs through conhost.exe --headless, further obscuring the process chain.

Exif Smuggling

An advanced variant embeds payloads within image Exif metadata fields, using null-byte concealment to pass Content-Type validation. The PowerShell extraction phase reads specific Exif tags from the cached image file rather than scanning for inline regex markers.

Why EDR Misses This

Most endpoint agents hook network API calls — WinINet, WinHTTP, socket-level — to flag suspicious downloads. Cache smuggling sidesteps all of it. The browser handles the HTTP fetch (trusted process, trusted destination), and the payload lands in cache through normal browsing behavior. When PowerShell later reads from a local file path, there is no network event to trigger. EDR is blind here.

When we tested this against browser cache forensics tools, the cached payloads were indistinguishable from legitimate image resources at the file-system level. Only the Content-Type mismatch at the proxy layer and the PowerShell-to-cache-directory access pattern gave it away. Side note: the regex markers (bTgQcBpv, 13371337) are the operator's weakest link — they are trivially signaturable, but only if you know to look inside cache directories.

Attack Chain

  1. Resource Development — Attacker builds ClickFix toolkit: payload generator, lure templates (Fortinet VPN, Chrome update, Word error), and hosting infrastructure (T1587.001, T1608.001, T1583.001)
  2. Initial Access — Victim visits compromised site or attacker-controlled domain; malicious payload cached as image resource via drive-by download (T1189, T1566.002)
  3. Execution — Victim pastes command into Run dialog, Explorer address bar, or PowerShell; script reads browser cache, extracts payload via regex markers, and executes (T1204.001, T1059.001, T1059.003)
  4. Defense Evasion — Payload masquerades as cached image (Content-Type mismatch); FileFix variant uses 139+ whitespace padding; HijackLoader uses DLL sideloading from temp directories (T1036.005, T1027.009, T1553.005)
  5. Persistence — Registry Run keys created pointing to temp directories with names like ChromeUpdate; service installation via T1569.002 (T1547.001)
  6. Credential Access — Lumma Stealer and infostealers access browser credential databases (Login Data, Cookies, Web Data) and crypto wallet directories (T1555.003, T1539)
  7. Collection and Exfiltration — Clipboard hijacking replaces crypto wallet addresses; data exfiltrated via Telegram Bot API, Microsoft Graph API, or Latrodectus /gate.php callbacks (T1115, T1567, T1071.001)
Cyber Security News reporting on threat actors advertising the new ClickFix browser cache payload delivery method on underground forums. Cyber Security News reporting on threat actors advertising the new ClickFix browser cache payload delivery method on underground forums.

Threat Actor Profile

The ClickFix cache smuggling toolkit is sold by an unidentified MaaS operator on underground forums. The seller advertised the builder with full source code and setup instructions for $300, with custom template rewrites available for $200 per template. The listing appeared on February 16-17, 2026, and was documented by Dark Web Informer.

The broader ClickFix ecosystem has been adopted by multiple threat groups since 2023. TA571, tracked by Proofpoint, distributed over 100,000 clipboard-paste phishing emails in early 2024. ClearFake integrated ClickFix with Keitaro traffic distribution systems and Binance Smart Chain hosting (EtherHiding). The Phantom Meet campaign, attributed to SNE/Scamquerteo by Sekoia, used fake Google Meet pages. Fortiguard documented variants deploying Havoc C2 through SharePoint with Graph API abuse. The $300 price point and source code availability signal a commodity-phase transition where any financially motivated operator can deploy cache smuggling at scale. Based on our tracking of 112 threats on the platform, this is the fastest we have seen a technique go from proof-of-concept to MaaS listing — under three months from first observation to underground sale.

Detection

Three queries. Three detection surfaces. Full kill chain coverage.

Threadlinqs Intelligence provides 9 production-ready detection rules for this threat targeting each phase of the kill chain.

Splunk SPL

This query hunts for the primary ClickFix exploitation chain: explorer.exe spawning PowerShell, with enrichment for cache directory access and known regex extraction markers.

SPLindex=sysmon sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1
| where (parent_process_name="explorer.exe" AND (process_name="powershell.exe" OR process_name="cmd.exe"))
    OR (parent_process_name="conhost.exe" AND match(process_command_line, "--headless"))
| eval cache_access=if(match(lower(process_command_line), "cache_data|cache2|inetcache"), 1, 0)
| eval regex_markers=if(match(process_command_line, "bTgQcBpv|mX6o0lBw|13371337"), 1, 0)
| eval encoded_cmd=if(match(process_command_line, "-[Ee]ncoded[Cc]ommand"), 1, 0)
| eval whitespace_pad=if(match(process_command_line, "^\s{50,}"), 1, 0)
| eval risk_score=cache_access40 + regex_markers50 + encoded_cmd20 + whitespace_pad30
| where risk_score >= 40 OR cache_access=1
| stats count, values(process_command_line) as commands, values(risk_score) as scores by src_host, user, parent_process_name
| sort -count
This query catches both the standard ClickFix chain (explorer spawning PowerShell) and the FileFix variant (whitespace-padded commands via conhost), with risk scoring for cache directory access and known extraction markers.

Microsoft KQL

Browser credential store access by non-browser processes signals the post-exploitation infostealer phase. This KQL union covers it: 
KQLlet browser_processes = dynamic(["chrome.exe", "msedge.exe", "firefox.exe", "brave.exe"]);
let credential_dbs = dynamic(["Login Data", "Cookies", "Web Data", "key4.db", "logins.json"]);
let cache_dirs = dynamic(["Cache_Data", "cache2", "INetCache"]);
union
(
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where FileName has_any (credential_dbs)
    | where InitiatingProcessFileName !in (browser_processes)
    | extend AlertType = "credential_theft"
),
(
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where InitiatingProcessFileName == "explorer.exe"
    | where FileName in~ ("powershell.exe", "cmd.exe")
    | where ProcessCommandLine has_any (cache_dirs)
    | extend AlertType = "cache_smuggling_execution"
),
(
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where ProcessCommandLine matches regex @"^\s{50,}"
    | extend AlertType = "filefix_whitespace"
)
| project Timestamp, DeviceName, AlertType, FileName, InitiatingProcessFileName, ProcessCommandLine
| sort by Timestamp desc
This union query covers three detection surfaces: infostealer credential theft (non-browser processes accessing credential databases), cache smuggling execution (explorer spawning PowerShell with cache directory references), and the FileFix whitespace padding variant.

Sigma

Catching cache smuggling at the proxy layer — Content-Type mismatches where image responses contain executable content flag the passive cache loading phase: 
SIGMAtitle: ClickFix Content-Type Mismatch — Image Response with Executable Content
id: 4b2e8f71-c9a3-4d67-b512-7e9f3a1c8d45
status: experimental
description: Detects Content-Type image responses containing ZIP, PE, or DLL magic bytes indicating browser cache smuggling payload delivery
references:
    - https://intel.threadlinqs.com/#TL-2026-0127
    - https://cybersecuritynews.com/threat-actors-advertising-new-clickfix-payload/
author: Threadlinqs Intelligence
date: 2026/02/22
tags:
    - attack.defense_evasion
    - attack.t1036.005
    - attack.initial_access
    - attack.t1189
logsource:
    category: proxy
    product: any
detection:
    selection_content_type:
        response_content_type|startswith: 'image/'
    filter_mismatch:
        response_body|re: '(PK\x03\x04|MZ\x90\x00|\x7fELF)'
    selection_domains:
        dest_domain|contains:
            - 'dlccdn.com'
            - 'fc-checker'
            - 'checker.dlccdn'
    selection_size:
        response_size|gt: 102400
    condition: (selection_content_type and filter_mismatch) or selection_domains or (selection_content_type and selection_size)
falsepositives:
    - Legitimate large image files (photography sites, CDNs)
    - WebP or AVIF images exceeding 100KB
level: high
Browse all 9 detection rules for this threat: View on Threadlinqs Intelligence
Proofpoint Threat Research — 'From Clipboard to Compromise: A PowerShell Self-Pwn' — documenting the ClickFix social engineering paradigm evolution. Proofpoint Threat Research — 'From Clipboard to Compromise: A PowerShell Self-Pwn' — documenting the ClickFix social engineering paradigm evolution.

Indicators of Compromise

Network Indicators

TypeIndicatorContext
Domainfc-checker.dlccdn.comClickFix Fortinet compliance checker lure
Domainchecker.dlccdn.comClickFix infrastructure domain
URL Pattern/gate.phpLatrodectus C2 callback endpoint
API AbuseMicrosoft Graph API (SharePoint)Havoc C2 communication channel
API AbuseTelegram Bot APIStealer exfiltration channel

File Indicators

TypeIndicatorContext
Regex MarkerbTgQcBpvCache extraction delimiter
Regex MarkermX6o0lBwCache extraction delimiter
Regex Marker13371337Cache extraction delimiter
File Path%LOCALAPPDATA%\Google\Chrome\User Data\Default\Cache\Cache_Data\Chrome cache smuggling target
File Path%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\Edge cache smuggling target
File Path%LOCALAPPDATA%\Mozilla\Firefox\Profiles\\cache2\Firefox cache smuggling target
File Path%LOCALAPPDATA%\FortiClient\complianceFortinet lure temp staging path
Processclient32.exe from %TEMP% or %APPDATA%NetSupport RAT non-standard path
DLLHTCTL32.DLL from temp directoriesNetSupport sideloading indicator
RegistryHKCU\...\Run pointing to %TEMP%\ChromeUpdatePersistence key

Behavioral Indicators

Timeline

DateEvent
2023-10-16Guard.io publishes EtherHiding research — Binance Smart Chain contract hosting as malware distribution
2024-03-01Proofpoint documents TA571 clipboard-paste social engineering across 100K+ phishing emails
2024-04-01ClearFake adopts ClickFix technique with Keitaro TDS and BSC hosting
2024-06-01ReliaQuest publishes first ClickFix-style execution documentation
2024-06-18Proofpoint publishes full "Clipboard to Compromise" report on PowerShell self-pwn chains
2024-10-17Sekoia documents "ClickFix Phantom Meet" campaign attributed to SNE/Scamquerteo
2025-02-27Fortiguard reports ClickFix deploying Havoc C2 via Microsoft SharePoint and Graph API abuse
2025-10-01Fortinet-themed ClickFix cache smuggling variant first observed
2025-12-01Exif smuggling variant proof-of-concept developed with null-byte concealment
2026-02-16Underground toolkit advertised: $300 builder with source code, $200 custom templates
2026-02-17Cyber Security News and Blackswan Cybersecurity publish technical analyses
2026-02-21Threadlinqs Intelligence publishes TL-2026-0127 with full MITRE ATT&CK mapping

MITRE ATT&CK Mapping

TacticTechniqueIDContext
Initial AccessDrive-by CompromiseT1189Compromised sites loading cached payloads
Initial AccessPhishing: Spearphishing LinkT1566.002Lure pages with fake error dialogs
ExecutionUser Execution: Malicious LinkT1204.001Victim pastes command from lure page
ExecutionPowerShellT1059.001Cache extraction and payload execution
ExecutionWindows Command ShellT1059.003FileFix Explorer address bar execution
Defense EvasionObfuscated Files or InformationT1027Base64-encoded commands, whitespace padding
Defense EvasionEmbedded PayloadsT1027.009Executable content in image container
Defense EvasionMatch Legitimate Name or LocationT1036.005Payloads masquerading as cached images
Defense EvasionDeobfuscate/Decode FilesT1140PowerShell regex extraction and decryption
Defense EvasionMark-of-the-Web BypassT1553.005Cached content bypasses MotW
PersistenceRegistry Run KeysT1547.001ChromeUpdate keys in temp directories
Credential AccessCredentials from Web BrowsersT1555.003Lumma Stealer accessing Login Data, Cookies
Credential AccessSteal Web Session CookieT1539Browser cookie database theft
CollectionClipboard DataT1115Crypto wallet address replacement
ExfiltrationExfiltration Over Web ServiceT1567Telegram Bot API, Graph API exfiltration
Command and ControlWeb ProtocolsT1071.001Latrodectus gate.php, Havoc SharePoint C2
DiscoveryVirtualization/Sandbox EvasionT1497WMI temperature sensor, MAC OUI checks
Full MITRE ATT&CK mapping with 28 techniques: View coverage on Threadlinqs
TL-2026-0127 on Threadlinqs Intelligence — ClickFix browser cache smuggling MaaS toolkit storing malware payloads in browser cache to bypass EDR and firewalls. TL-2026-0127 on Threadlinqs Intelligence — ClickFix browser cache smuggling MaaS toolkit storing malware payloads in browser cache to bypass EDR and firewalls.

Recommendations

  1. Train users immediately — conduct targeted awareness training on paste-this-fix social engineering; users should never paste commands from websites into PowerShell, Run dialog, or Explorer address bar
  2. Deploy behavioral EDR rules — monitor for PowerShell or script interpreters accessing browser cache directories (Cache_Data, cache2, INetCache); alert on explorer.exe spawning powershell.exe
  3. Enforce PowerShell constraints — implement Constrained Language Mode via GPO; deploy AppLocker or WDAC policies restricting PowerShell to signed scripts for standard users
  4. Block at the proxy — implement Content-Type validation blocking image responses containing ZIP, PE, or DLL magic bytes; sinkhole known ClickFix domains (fc-checker.dlccdn.com, checker.dlccdn.com)
  5. Monitor persistence indicators — hunt for Registry Run keys pointing to temp directories, client32.exe (NetSupport) in non-standard paths, and unsigned DLLs loading from %TEMP%

References

Full threat intelligence, detection rules, and IOC feeds are available on Threadlinqs Intelligence. Track this threat: TL-2026-0127.*

// related_reports

TL-2026-0120
Matryoshka ClickFix macOS Variant TL-2026-0128
AI Prompt Injection Attacks on Enterprise LLMs TL-2026-0122
Password Manager Zero-Knowledge Bypass