ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits

Microsoft and multiple security vendors describe a surge in ClickFix attacks that coerce users into pasting commands which then execute malicious payloads staged via browser cache smuggling; the chain uses VBScript and PowerShell loaders to fetch additional stages (cab.dat), load .NET assemblies in-memory, inject into legitimate processes, and exfiltrate credentials, with observed deployment of GeniexLoader/GeniexRAT and Vidar Stealer. Campaigns—attributed to both cybercriminal and nation-state actors—leverage thousands of compromised sites and techniques like on-chain EtherHiding for infrastructure rotation; recommended defenses include cloud/web protection, application control, PowerShell script-block logging, and hunting for suspicious browser and Run dialog activity.