ClickFix Exploits Browser Cache to Evade Windows Execution Restrictions

How the Cache Trick Works

A new variant of the ClickFix malware has been uncovered that hijacks compromised websites to deliver malicious code via the browser cache, allowing attackers to bypass Windows’ built‑in execution limits. The technique was first identified on October 6, 2026, by security researchers at Ravie Lakshmanan, who noted that users could be tricked into running harmful payloads without downloading them directly.

The attack diverges from traditional ClickFix methods, which typically involve downloading a payload and executing it from the local machine. Instead, the compromised site pre‑fetches a malicious script and stores it in the browser’s cache. When a user later visits a different page on the same site, the cached script is automatically executed, granting the attacker remote code execution privileges. This approach exploits the fact that Windows blocks execution of files downloaded from the internet, but does not apply the same restriction to cached data.

When a user visits the malicious website, the attacker injects a small JavaScript snippet that silently downloads a larger, malicious payload into the browser’s cache. The script then redirects the user to a benign-looking page that appears to be part of the same site. Because the payload is already cached, the browser loads it from memory rather than from the internet, and the operating system treats it as a local file. As a result, the payload runs without triggering Windows’ download‑to‑execute warning. Security analysts estimate that this method can bypass the Windows SmartScreen filter in approximately 95% of cases, making it a potent tool for attackers.

Is This the End of Browser‑Based Exploits?

The technique relies on the fact that cached files are not flagged by Windows as „downloaded from the internet,” a loophole that has not been addressed in recent updates. By exploiting this flaw, attackers can deliver ransomware, credential stealers, or other malware with a higher success rate than previous ClickFix variants. Early samples show that the payload can establish a command‑and‑control channel within minutes of execution, enabling rapid lateral movement across corporate networks.

Security experts are concerned that the new ClickFix variant signals a shift toward more sophisticated browser‑based delivery mechanisms. By using the cache, attackers can evade traditional endpoint protection that focuses on download monitoring. The technique also sidesteps many of the heuristics employed by modern antivirus software, which often flag suspicious network activity but not cached code execution.

Companies are urged to update their web filtering and sandboxing policies. Implementing a stricter cache‑control header and disabling automatic script execution from cached content can mitigate the threat. Additionally, organizations should educate users about the risks of visiting unknown or compromised sites, even if they appear harmless. The attack underscores the need for a layered defense strategy that includes both network‑level controls and endpoint hardening.

Frequently Asked Questions

What is ClickFix and how does it normally work? ClickFix is a family of malware that tricks users into executing malicious code by exploiting vulnerabilities in web browsers and operating systems. Traditionally, it downloads a payload from a remote server and runs it locally.

How does the new cache technique bypass Windows restrictions? The payload is stored in the browser’s cache, which Windows treats as a local file. Because it is not considered a downloaded file, Windows’ execution limits do not apply, allowing the malware to run without user intervention.

What can users do to protect themselves from this attack? Users should keep browsers and operating systems up to date, avoid visiting suspicious sites, and use security tools that monitor script execution from cached content. Organizations should enforce strict cache‑control policies and educate staff about the risks of compromised websites.