Attackers hide malicious code in the browser cache before showing a fake CAPTCHA that tricks users into running it. GajIPS detects the delivery, lure pages and malicious infrastructure.
Severity: HIGH · Priority: P2 — novel ClickFix cache-smuggling variant, investigate on hit
These rules detect a technically novel variant of ClickFix attacks, documented by Microsoft Threat Intelligence on October 3, 2026, in which the malicious payload is hidden inside the victim's browser cache before the attacker asks them to do anything. The technique — called browser cache smuggling — was originally described by Expel's Marcus Hutchins in October 2025, but this campaign introduces a new twist: the cached payload is retrieved not by a content marker or filename, but purely by file size, allowing a shorter, harder-to-detect clipboard command to fit inside the Windows Run dialog's character limit.
The attack chain works as follows. When a user visits a compromised website, the page silently forces their browser to cache a large VBScript file disguised as a PNG image — the server sends a Content-Type: image/png header, but the file body is not a PNG and contains Windows scripting commands. The ClickFix fake-CAPTCHA prompt then instructs the user to paste a short command that invokes cmd.exe to search Firefox's profile cache directory for files beginning with "f_" and matching a specific file size set by the attacker. When found, the cached entry is copied to %LOCALAPPDATA%\Temp\t.vbsand executed through wscript.exe. The VBScript gathers host information via WMI, retrieves a PowerShell script (v.ps1) from cocojambo.us.com/alfa, and launches PowerShell with execution-policy bypass and no user profile. This PowerShell stage compiles .NET code on the victim's machine using csc.exe and cvtres.exe, then injects into timeout.exe to harvest browser credentials and device data. A further memory-resident stage is fetched from capsysnet.vg, and the injected process maintains persistent contact with ciliabula.cc via a Python payload launched through a scheduled task.
A hit on the response-detection rules indicates a device is actively receiving a cache-smuggled VBScript payload — the attack is in progress but no command has been executed yet; blocking at this point prevents the infection. A hit on the domain rules or the lure-page rule indicates the infection chain is already running or the user is on the lure page. In either case, identify the device and check for t.vbs in %LOCALAPPDATA%\Temp, unexpected scheduled tasks running Python, timeout.exe behaving unexpectedly, and the v.ps1 script in memory or recent PowerShell history. Because the final stage specifically targets browser-stored credentials, treat all saved passwords in Chrome, Edge, Firefox, and Brave as potentially exposed and rotate them from a known-clean device.