ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits

Microsoft Threat Intelligence has uncovered a new ClickFix variant that stashes its malicious script inside the browser cache instead of fetching it remotely, letting attackers get around the roughly 260-character limit of the Windows Run dialog (Win + R). Compromised sites secretly pre-load a script disguised as a PNG image into the browser's cache; victims tricked into pasting a short command then trigger execution of that already-cached content rather than downloading anything new. In the observed chain, a VBScript scans Firefox profile folders for files matching expected byte sizes, copies a matching cache entry into a .vbs file, and runs it via wscript.exe, eventually pulling PowerShell stages that inject code into a legitimate process (timeout.exe) to steal browser and device credentials. No specific CVE is tied to this technique, but it builds on prior cache-smuggling tricks documented since late 2025 and underscores why users should never paste 'fix' commands into Run, Terminal, or PowerShell prompts.