New ClickFix variant hides VBScript payload in PNG cache

A new ClickFix variant uses compromised sites to pre-fetch a VBScript payload into the browser cache, disguised as a PNG image. Victims are then lured into running the payload, giving attackers a stealthy delivery path that avoids direct download triggers. The technique exploits browser caching behavior to hide malicious scripts in plain sight. The Hacker News report describes the mechanism but does not cite confirmed victim counts or specific campaigns beyond the method itself.

The story matters because ClickFix is an established social-engineering framework that relies on user interaction rather than software exploits, making it hard to block with traditional vulnerability patches. By smuggling payloads through browser caches, the variant may bypass basic network inspection and file-type filters. Watch for IOCs linking this caching technique to active campaigns, and for browser vendors to adjust cache-handling policies.