ClickFix Attack Hides VBScript Payload in Browser Cache

Microsoft observed a ClickFix campaign that pre-fetched a VBScript payload into browser cache and tricked users with a fake CAPTCHA to paste and run a command via Windows Run; the command located a cached file (named f_*), copied it as a .vbs, executed it to gather host details, ran PowerShell, performed in-memory code loading and process injection for credential theft, and achieved persistence by unpacking Python and creating a scheduled task. Microsoft Defender detects variants as Trojan:Win32/ClickFix and Trojan:Win32/TermFix and recommends enabling cloud protection, application controls, PowerShell logging, and hunting for unusual browser, WScript, PowerShell and scheduled-task activity.