Microsoft’s own threat-intelligence team has flagged a new malware technique that’s specifically designed to slip past the antivirus and endpoint protection most businesses rely on — not by being more advanced, but by hiding in a place those tools don’t usually look closely: your browser’s cache.
What this technique actually does
It’s a variant of a known trick called ClickFix (sometimes “FileFix”) — the kind of attack where someone is talked into copying and pasting a command themselves, often via a fake “fix” prompt on a dodgy website. The new twist, which Microsoft’s threat-intel team described directly, is that the malicious payload gets hidden inside the browser’s cache, disguised as an ordinary PNG image file. It isn’t flagged by any obvious marker — most security tools identify it only by its unusual file size, since it doesn’t look like malware by any of the signatures they’re trained to check. Once triggered, the hidden payload runs as a script that steals credentials stored in the browser or on the device.
The reason this matters is specifically because it targets how most endpoint security works: scanning files for known signatures or patterns. A payload disguised as cached image data, sitting somewhere a scanner isn’t routinely inspecting in depth, can pass straight through that kind of check.
The part worth taking seriously
Having antivirus or EDR (endpoint detection and response) software installed is still genuinely useful protection — this isn’t a reason to abandon it. But it’s a reminder that no single layer of protection, including the technical one, catches everything. ClickFix-style attacks succeed because a person is convinced to actively do something — paste a command, run a “fix” — not because a system was silently breached. That means the most effective defence against this specific technique is the same one that’s always mattered most: knowing not to copy and paste commands from a website or pop-up claiming to “fix” something, no matter how convincing the prompt looks.
What to do about it
1. Make sure whoever handles IT for your business is aware of this specific ClickFix/cache-smuggling variant, not just “malware in general” — the specific trick is what makes it worth flagging. 2. Reinforce the one habit that actually stops this: nobody pastes a command into a terminal, Run dialog, or browser console because a website told them to, regardless of how official it looks. 3. If anyone has done exactly that recently in response to an unexpected “fix this” prompt, it’s worth having that device checked rather than assuming nothing happened.
This is still an emerging technique without a formal advisory yet, so the detail may evolve — but the underlying defence doesn’t change regardless of how the malware itself is packaged.
If you’d like a short, plain-language briefing for your team on ClickFix-style prompts specifically (not a generic security slideshow), that’s something our cybersecurity team can put together.
The lesson here isn’t that your antivirus failed you — it’s that the most convincing attacks are often aimed at the person using the computer, not the computer itself.