Executive Summary
A sophisticated social engineering technique known as 'ClickFix' has evolved to incorporate 'Browser Cache Smuggling.' This method allows attackers, including North Korean-aligned Stardust Chollima and Russian state-sponsored Sandworm, to silently deliver malicious payloads by disguising them as benign static resources (like images) that are automatically stored in a web browser's local cache. Because the files are stored without extensions or as parts of database files, they frequently evade traditional Antivirus and EDR scanning.
The attack chain involves social engineering users to visit a compromised site (often leveraging CVE-2026-6854 in WordPress) which triggers the cache download. Users are then prompted to run a 'fix'—typically a PowerShell or VBScript command—that retrieves the payload from the local cache rather than a remote server. This bypasses character limit restrictions in the Windows Run dialog (260 characters) and makes the execution command appear more benign as it does not initiate an immediate external download.
This technique is increasingly used in campaigns targeting financial services and government sectors globally. Its ability to turn the victim's own browser into a delivery channel, combined with the use of legitimate tools like PowerShell and WScript for execution, poses a high risk to organizations relying on standard perimeter and endpoint defenses.