Executive Summary
Microsoft Threat Intelligence has identified a new evolution of the 'ClickFix' phishing campaign that utilizes browser cache smuggling to bypass the 260-character limit of the Windows Run (Win+R) dialog. By pre-fetching a malicious script disguised as a PNG image into the victim's browser cache, attackers ensure the heavy payload is already resident on the disk before tricking the user into executing a short, manual command.
The attack chain involves a multi-stage process where a VBScript locates the cached payload, executes it via wscript.exe, and eventually retrieves a PowerShell script that injects .NET assemblies into the legitimate timeout.exe process. This technique minimizes network footprints at the moment of execution and avoids writing the final malware to disk, complicating detection by traditional antivirus solutions.
This activity is significant due to its reliance on user interaction to bypass automated sandboxes and its use of living-off-the-land binaries (LotBins) to hide credential theft activities. Organizations should focus on monitoring unusual process behavior involving wscript.exe and timeout.exe, as well as auditing browser profile directories for suspicious file artifacts.