ClickFix Cache Smuggling (Firefox Cache Size-Match)

Attacker objective: steal browser and device credentials from Windows users who can be talked into pasting a command into the Run dialog. The distinctive part of this campaign is how the payload arrives. Compromised websites pre-fetch a script into the visitor's browser cache, disguised as a PNG image. When the victim later follows a fake Cloudflare human-verification prompt and pastes the supplied command into Run, that command does not download anything. It only has to locate a payload that is already on disk.

That design defeats two defensive assumptions at once. First, the Run dialog truncates input at roughly 260 characters, which normally limits how much logic a ClickFix command can carry. A locate-and-launch command is short enough to fit. Second, the payload never traverses the network at execution time, so download-based detections, proxy logs and DNS telemetry for the first stage see nothing.

Per the reporting on Microsoft Threat Intelligence's findings, the command enumerates files whose names begin with f_ under the Firefox profile folders, compares each file's byte length to an expected value (earlier cache-smuggling variants searched for a content marker instead), copies the match to %LOCALAPPDATA%\Temp\t.vbs and runs it with wscript.exe. Follow-on stages are PowerShell, .NET code compiled on the victim host and injected into the legitimate timeout.exe, and a scheduled task that launches a Python payload. Three C2 domains were published.

Attribution: Microsoft did not attribute this campaign to a named actor, and this pack does not either. The press coverage also states that Microsoft did not say which credential stealer sits at the end of the chain. One secondary article connects ClickFix fake-CAPTCHA pages to Vidar Stealer in general (a separate CTM360 statistic), but no cited source ties Vidar to this chain, so this pack does not claim it.

Highest-value defensive angle: hunt the endpoint artifacts, not the download. The Run dialog records every pasted command in the RunMRU registry key, which is a near-zero-false-positive signal for any ClickFix variant. After that, the process tree is unusually clean to describe: explorer.exe to cmd.exe (cache enumeration) to wscript.exe running t.vbs from Temp, then PowerShell under wscript.exe, and a timeout.exe that resolves DNS names (it never legitimately does).

Defender priority: treat any host with a Run-dialog command that touches Firefox\Profiles as a credential-theft incident, not a malware cleanup. Stolen browser credentials and session material outlive the endpoint. Revoke sessions and rotate credentials for the user before closing the host ticket. Note that the staging step targets Firefox cache paths in the reported variant, but the lure can be shown on any browser, so users on other browsers are not exempt from the credential-theft stages.

Hunter notes & deliberate omissions

• The primary Microsoft post was not reachable, and the Expel write-up of the original cache-smuggling technique returned only truncated content. Microsoft disclosed this through an @MsftSecIntel thread on 2026-10-03, not a security-blog post, so there is no first-party article to cite. This pack is therefore built on press coverage and says so in the Confidence field. Re-grade it if Microsoft publishes a full write-up.
• The three domains are single-lineage. Four outlets now list them, but all four relay the same Microsoft thread, so outlet count is not independent confirmation of the indicators themselves. All three ship as detect, never prevent, and this is the reason.
• Not the published DOUBLECUP pack. DOUBLECUP, already covered by DOUBLECUP-ClickFix-LaaS-Hunt.html, is a separate ClickFix-as-a-service cluster reported by SOCRadar on 2026-08-03 that also hides payloads in cached PNGs. It differs on mechanism and infrastructure: it extracts with findstr or certutil, impersonates SaaS login pages (NetSuite, Odoo, HubSpot, Salesforce), and runs on its own panel infrastructure, which is listed in that pack rather than repeated here. It does not enumerate f_-prefixed Firefox profile files and shares no infrastructure with this campaign. Cache smuggling is now a technique used by more than one unrelated actor, so treat the two packs as complementary rather than overlapping.
• No file hashes and no expected-size values are published. The expected byte length varies per variant, so the pack hunts the size-comparison behavior and does not assert a size. The IOC CSV carries explicit REPLACE_WITH_SHA256 placeholders rather than invented values.
• The Run-dialog command string is intentionally not reproduced. Its structure is described (recursive enumeration of f_ files in the Firefox profile folder, byte-length comparison, copy to a .vbs in Temp, wscript.exe launch) and its artifacts are hunted.
• Out of scope by design: GeniexLoader, GeniexRAT and the actor Stardust Chollima / BlueNoroff belong to separate CrowdStrike reporting about a different ClickFix cluster that the Hacker News article lists alongside this campaign. They are not part of this Microsoft campaign and no indicator from them is shipped here.
• .NET compile-on-host: the sources say .NET code is compiled on the victim. They do not name the compiler. Q7 hunts the generic mechanisms (csc.exe / vbc.exe under a script host) and is labelled an inference.

Hypotheses (ordered by fidelity)

Attack chain

Specificity warning: t.vbs, v.ps1 and cab.dat are generic filenames. Hunting the bare name will produce false positives and miss renamed variants. They are listed as low-specificity context and are hunted in this pack only in combination with parent process, path and behavior.

• N1 · RunMRU on a suspect host. In the user's registry hive, review HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU. Any entry containing Firefox and Profiles, or a script host and a Temp path, is a confirmed lure execution. This is the artifact Microsoft names for every ClickFix variant.
• N2 · Temp folder and cache triage. On a suspect host list $env:LOCALAPPDATA\Temp\*.vbs and compare against the Firefox cache2 entries that begin with f_ under $env:LOCALAPPDATA\Mozilla\Firefox\Profiles (match by length). Preserve before deleting.
• N3 · PowerShell logs. Search Event 4104 for script blocks whose parent was wscript.exe, and for execution-policy changes shortly after a t.vbs run. Requires script block logging.
• N4 · Scheduled tasks. Get-ScheduledTask | Where-Object { $_.Actions.Execute -match 'python' } and review each task's action path and author. Event 4698 gives the registration time.
• N5 · Proxy and DNS logs. Sweep for the three domains (section 10). Remember the first stage produces no network event, so proxy logs only show the follow-on stages.
• N6 · Identity plane. For any confirmed host, review sign-ins for the user across SaaS for new locations or token replay after the execution time.

All ten queries describe behavior reported for this campaign and are written against the Falcon data model. The first stage produces no network event, so none of these depend on a download. Every filename match uses the FileName basename field and directories are matched with a separator-free pattern such as Firefox.{1,2}Profiles, so no path slash is needed inside a regex. Run Q1 first: it fires upstream of execution.

// HUNT: Run-dialog paste referencing Firefox Profiles with script or copy action (ClickFix cache smuggling)
// MITRE: T1204.004, T1083
// CONF: high | FP: low | COST: low | REQUIRES: registry telemetry (RunMRU writes)
// FALSE POSITIVES: an administrator typing a legitimate profile-cleanup command into Run
// TUNING: exclude your IT admin asset group if it types such commands into Run
#event_simpleName=/^(RegGenericValueUpdate|AsepValueUpdate|RegSystemConfigValueUpdate)$/
| RegObjectName=/RunMRU/i
| RegStringValue=/Firefox.{1,2}Profiles/i
| RegStringValue=/(\.vbs|wscript|cmd|copy|for\s)/i
| table([@timestamp, ComputerName, UserName, RegObjectName, RegValueName, RegStringValue, aid], limit=200)

// HUNT: cmd.exe from explorer enumerating Firefox Profiles and staging a script (cache smuggling locate step)
// MITRE: T1059.003, T1083, T1204.004
// CONF: high | FP: low | COST: low | REQUIRES: ProcessRollup2
// FALSE POSITIVES: rare; a user script that backs up Firefox profile data by hand
// TUNING: none expected; review any hit manually
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^cmd\.exe$/i
| ParentBaseFileName=/^explorer\.exe$/i
| CommandLine=/Firefox.{1,2}Profiles/i
| CommandLine=/(\.vbs|wscript|copy)/i
| table([@timestamp, ComputerName, UserName, GrandparentBaseFileName, ParentBaseFileName, FileName, CommandLine, aid], limit=200)

// HUNT: wscript.exe executing a one-letter t.vbs from Temp (cache smuggling staged script)
// MITRE: T1059.005, T1204.004
// CONF: high | FP: low | COST: low | REQUIRES: ProcessRollup2
// FALSE POSITIVES: very rare; a user script that happens to be named t.vbs in Temp
// TUNING: to hunt renamed variants, replace the t.vbs filter with any .vbs under Temp and add exclusions for your login scripts
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^wscript\.exe$/i
| CommandLine=/Temp.{1,2}t\.vbs/i
| ParentBaseFileName=/^(cmd|explorer|conhost)\.exe$/i
| table([@timestamp, ComputerName, UserName, GrandparentBaseFileName, ParentBaseFileName, FileName, CommandLine, aid], limit=200)

// HUNT: PowerShell launched by wscript or cscript (cache smuggling v.ps1 stage)
// MITRE: T1059.001, T1059.005
// CONF: medium | FP: medium | COST: low | REQUIRES: ProcessRollup2
// FALSE POSITIVES: legacy VBScript login or inventory scripts that call PowerShell
// TUNING: exclude known script paths or service accounts below; keep the Temp and ExecutionPolicy filters as the high-signal tier
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(powershell|pwsh)\.exe$/i
| ParentBaseFileName=/^(wscript|cscript)\.exe$/i
// narrow to the high-signal tier by uncommenting:
// | CommandLine=/(Temp|ExecutionPolicy|Bypass|Hidden)/i
| table([@timestamp, ComputerName, UserName, GrandparentBaseFileName, ParentBaseFileName, FileName, CommandLine, aid], limit=200)

// HUNT: timeout.exe resolving DNS names (injected process, cache smuggling credential-theft stage)
// MITRE: T1055, T1071.001
// CONF: high | FP: low | COST: low | REQUIRES: DnsRequest with process context (validate in tenant)
// FALSE POSITIVES: none expected; timeout.exe performs no network lookups
// TUNING: none expected; treat every hit as an incident until proven otherwise
#event_simpleName=DnsRequest
| ContextBaseFileName=/^timeout\.exe$/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, DomainName, aid], limit=200)

// HUNT: timeout.exe started by a script host, Python or proxy-execution binary (injection target creation)
// MITRE: T1055, T1036
// CONF: medium | FP: medium | COST: low | REQUIRES: ProcessRollup2
// FALSE POSITIVES: VBScript or Python automation that uses timeout as a sleep
// TUNING: exclude your known automation script paths in ParentCommandLine or the owning service account; pair any hit with Q5 and Q3
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^timeout\.exe$/i
| ParentBaseFileName=/^(wscript|cscript|mshta|python|pythonw|rundll32|regsvr32)\.exe$/i
| table([@timestamp, ComputerName, UserName, GrandparentBaseFileName, ParentBaseFileName, FileName, CommandLine, aid], limit=200)

// HUNT: .NET compiler or archive tool launched by a script host (compile-on-victim stage)
// MITRE: T1027.004, T1059.001, T1140
// CONF: high | FP: medium | COST: low | REQUIRES: ProcessRollup2
// SOURCE: csc.exe, cvtres.exe and tar.exe are named in the CyberSecurityNews indicator list
// FALSE POSITIVES: administrative PowerShell using Add-Type; some software installers and management agents; legitimate tar.exe use
// TUNING: exclude management-agent parents and your admin asset group; prioritise hits within an hour of a Q3 or Q4 hit on the same aid. Drop the tar branch first if it is noisy, it is the weakest of the three
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(csc|vbc|cvtres|tar)\.exe$/i
| GrandparentBaseFileName=/^(wscript|cscript|powershell|pwsh)\.exe$/i or ParentBaseFileName=/^(wscript|cscript|powershell|pwsh)\.exe$/i
| table([@timestamp, ComputerName, UserName, GrandparentBaseFileName, ParentBaseFileName, FileName, CommandLine, aid], limit=200)

// HUNT: scheduled task whose action launches Python (cache smuggling persistence)
// MITRE: T1053.005, T1059.006
// CONF: medium | FP: medium | COST: low | REQUIRES: ScheduledTaskRegistered (validate in tenant), ProcessRollup2
// SOURCE: pythonw.exe is named in the CyberSecurityNews indicator list
// FALSE POSITIVES: developer, data and automation teams scheduling Python jobs
// TUNING: restrict to endpoints without a Python developer baseline; focus on tasks whose executable sits in a user-writable path such as AppData or Temp. pythonw.exe on a non-developer host is the higher-fidelity half of this query
#event_simpleName=/^(ScheduledTaskRegistered|ProcessRollup2|SyntheticProcessRollup2)$/
| TaskExecutable=/pythonw?(\.exe)?/i or FileName=/^pythonw\.exe$/i or (FileName=/^schtasks\.exe$/i and CommandLine=/pythonw?/i)
| table([@timestamp, ComputerName, UserName, FileName, TaskName, TaskExecutable, TaskAuthor, CommandLine, aid], limit=200)

// HUNT: DNS resolution of the three published campaign domains (atomic IOC sweep)
// MITRE: T1071.001
// CONF: high | FP: low | COST: medium | REQUIRES: DnsRequest
// SOURCE: The Hacker News and iTnews coverage of the Microsoft Threat Intelligence report, 2026-10-06
// FALSE POSITIVES: none expected; any hit warrants immediate host triage
// NOTE: absence of hits is NOT evidence of absence
#event_simpleName=/^(DnsRequest|SuspiciousDnsRequest)$/
| DomainName=/(^|\.)(cocojambo\.us\.com|capsysnet\.vg|ciliabula\.cc)$/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, DomainName, aid], limit=500)

// HUNT: interpreter or shell typed into Run with Temp, script or remote reference (ClickFix variant net)
// MITRE: T1204.004
// CONF: medium | FP: medium | COST: low | REQUIRES: registry telemetry (RunMRU writes)
// FALSE POSITIVES: IT staff running legitimate admin one-liners from Run
// TUNING: exclude your admin asset group and privileged accounts; tighten the second filter to \.vbs and Temp for a quieter list
#event_simpleName=/^(RegGenericValueUpdate|AsepValueUpdate|RegSystemConfigValueUpdate)$/
| RegObjectName=/RunMRU/i
| RegStringValue=/(wscript|cscript|powershell|cmd|mshta)/i
| RegStringValue=/(\.vbs|Temp|AppData|http|-enc|Profiles)/i
| table([@timestamp, ComputerName, UserName, RegObjectName, RegValueName, RegStringValue, aid], limit=200)

Four queries are clean enough to promote from hunt to Custom IOA. None of them blocks a legitimate Windows binary: every rule is detect-only, and the pack recommends no prevention action at all, because the only actor-controlled indicators are three domains that rest on one lineage of reporting.

Deployment path

1. Endpoint security → Configuration → Custom IOA rule groups. Create a group named for this campaign and attach it to a pilot prevention policy.
2. Create each rule in Monitor (detect-only) severity and leave it for one business week.
3. Do not raise any rule to Block. cmd.exe, wscript.exe, timeout.exe and the Firefox binaries are legitimate and a block rule will eventually disrupt benign activity.
4. The three domains belong in IOC Management as detect entries; import the CSV from section 10.

Investigate-only queries

• Q4, Q6, Q7, Q8, Q10: run as scheduled searches to a hunt queue. Their FP profile needs a local baseline before alerting.
• Correlation is where fidelity lives. Any host hitting two or more of Q1 to Q8 within 24 hours should escalate regardless of the individual ratings.

Read before importing: all three domains import as detect, not prevent. Both articles that list them relay the same Microsoft findings, so they are one lineage of evidence, and the primary post was not retrieved. The SHA256 row is a REPLACE_WITH_SHA256 placeholder because no hash has been published. Generic filenames are deliberately not in the CSV.

type,value,action,severity,expiration,description,tags
domain,cocojambo.us.com,detect,high,2027-04-06,ClickFix cache smuggling PowerShell stage host (path /alfa),campaign:ClickFixCacheSmuggling
domain,capsysnet.vg,detect,high,2027-04-06,ClickFix cache smuggling second-stage host,campaign:ClickFixCacheSmuggling
domain,ciliabula.cc,detect,high,2027-04-06,ClickFix cache smuggling C2 domain,campaign:ClickFixCacheSmuggling
sha256,REPLACE_WITH_SHA256,detect,high,2027-04-06,Staged t.vbs payload - NO HASH PUBLISHED,campaign:ClickFixCacheSmuggling

ClickFix cache smuggling - behavioral signatures

B1  RunMRU value naming the Firefox Profiles folder plus a script or copy action
B2  cmd.exe, parent explorer.exe, command line enumerating Firefox Profiles
B3  wscript.exe running a one-letter .vbs from a Temp folder (parent cmd / explorer)
B4  powershell.exe parented by wscript.exe or cscript.exe
B5  timeout.exe performing DNS lookups or network connections
B6  timeout.exe parented by a script host, Python or a proxy-execution binary
B7  csc.exe / cvtres.exe / tar.exe parented by a script host or PowerShell (compile-on-victim, unpack)
B8  pythonw.exe launched from a scheduled task on a host with no Python baseline
B8  scheduled task whose action launches a Python interpreter

LOW-SPECIFICITY NAMES (never hunt alone): t.vbs, v.ps1, cab.dat
KEY INSIGHT: the cached file is found by SIZE not content, and the first stage has no network event.

Folder enumerated : %LOCALAPPDATA%\Mozilla\Firefox\Profiles\ (files named f_*)
Staged script     : %LOCALAPPDATA%\Temp\t.vbs
Launcher          : wscript.exe
Stage names       : v.ps1 (PowerShell), cab.dat (next stage)
Injection target  : timeout.exe (legitimate Windows binary, never block)
Forensic artifact : HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
Attribution       : none (Microsoft did not name an actor)

# Run dialog removed for the user?
Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer' -Name NoRun -ErrorAction SilentlyContinue
# Windows Script Host disabled for the user?
Get-ItemProperty 'HKCU:\Software\Microsoft\Windows Script Host\Settings' -Name Enabled -ErrorAction SilentlyContinue
# Script block logging on?
Get-ItemProperty 'HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -Name EnableScriptBlockLogging -ErrorAction SilentlyContinue

Work these in order. A query that has not cleared gate 2 has no business being an alert.

Controls are ordered by leverage against this chain. The campaign needs three things from the endpoint: a Run dialog to paste into, Windows Script Host to run the staged .vbs, and no logging on PowerShell. Remove or watch each one.

Test every playbook on a pilot ring before fleet deployment. P1 and P2 change visible user behavior. Each playbook lists its prerequisites, reboot requirement and rollback.

P1 · Remove the Run dialog (per-user policy)

# Prerequisites: run as the target user, or push through GPO / user logon script. Pilot ring first.
# Reboot required: no (sign out and back in, or restart Explorer, for the change to apply)
# Rollback: Remove-ItemProperty -Path $k -Name NoRun   then sign out and back in

$k = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer'
if (-not (Test-Path $k)) { New-Item -Path $k -Force | Out-Null }
New-ItemProperty -Path $k -Name NoRun -PropertyType DWord -Value 1 -Force | Out-Null

# Verify
Get-ItemProperty -Path $k -Name NoRun

P2 · Disable Windows Script Host

# Prerequisites: local administrator. Inventory VBScript / JScript login scripts first.
# Reboot required: no
# Rollback: Remove-ItemProperty -Path $k -Name Enabled   (WSH is on by default when the value is absent)

$k = 'HKLM:\SOFTWARE\Microsoft\Windows Script Host\Settings'
if (-not (Test-Path $k)) { New-Item -Path $k -Force | Out-Null }
New-ItemProperty -Path $k -Name Enabled -PropertyType DWord -Value 0 -Force | Out-Null

# Verify (a .vbs double-click should now report that Windows Script Host access is disabled)
Get-ItemProperty -Path $k -Name Enabled

P3 · PowerShell script block and module logging

# Prerequisites: local administrator; size the PowerShell Operational log (for example 512 MB) first.
# Reboot required: no
# Rollback: set both values back to 0 (or delete the two policy keys)

$sb = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging'
$ml = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging'
foreach ($p in $sb, $ml) { if (-not (Test-Path $p)) { New-Item -Path $p -Force | Out-Null } }
New-ItemProperty -Path $sb -Name EnableScriptBlockLogging -PropertyType DWord -Value 1 -Force | Out-Null
New-ItemProperty -Path $ml -Name EnableModuleLogging -PropertyType DWord -Value 1 -Force | Out-Null

# Verify: run any command, then look for Event 4104
Get-WinEvent -LogName 'Microsoft-Windows-PowerShell/Operational' -MaxEvents 3 | Select-Object TimeCreated, Id

P4 · ASR script rules in Audit mode

# Prerequisites: Microsoft Defender Antivirus active; confirm both GUIDs against Microsoft Learn first.
# Reboot required: no
# Rollback: Remove-MpPreference -AttackSurfaceReductionRules_Ids $ids   (or set the action to Disabled)

$ids = 'd3e037e1-3eb8-44c8-a917-57927947596d', '5beb7efe-fd9a-4556-801d-275e5ffc04cc'
Add-MpPreference -AttackSurfaceReductionRules_Ids $ids -AttackSurfaceReductionRules_Actions AuditMode, AuditMode

# Verify
(Get-MpPreference).AttackSurfaceReductionRules_Ids

P5 · Read-only triage on a suspect host

# Prerequisites: run as the affected user on an isolated host; do not delete anything yet.
# Reboot required: no
# Rollback: none required, this script only reads and lists

# 1. Pasted Run-dialog history
Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU' | Format-List

# 2. Staged scripts in Temp, with hashes
Get-ChildItem $env:LOCALAPPDATA\Temp -Filter *.vbs -ErrorAction SilentlyContinue |
  Get-FileHash -Algorithm SHA256 | Format-Table Hash, Path -AutoSize

# 3. Firefox cache entries named f_*, with byte length (match is by size, so record it)
Get-ChildItem "$env:LOCALAPPDATA\Mozilla\Firefox\Profiles" -Recurse -Filter 'f_*' -ErrorAction SilentlyContinue |
  Sort-Object Length | Select-Object Length, FullName -First 50

# 4. Scheduled tasks that launch Python
Get-ScheduledTask | Where-Object { $_.Actions.Execute -match 'python' } | Select-Object TaskName, TaskPath

Sequencing rule: the credential-theft stage means the loss happens after the endpoint event. Isolate the host, but do not let endpoint work delay credential and session resets for the user.

Gap summary

• The cache staging itself is invisible by design. The first stage needs no download and writes no unusual file. Coverage starts at the Run-dialog paste (Q1) and the locate step (Q2).
• Size is not hunted. The expected byte length varies per variant and was not published, so no query asserts one.
• Credential theft is covered by response, not detection. Treat any confirmed hit as a credential exposure (C3).

Validation: gates G1 to G6 in section 11 govern promotion. No query proceeds to alert before clearing G2, and none is recommended for Block.

Provenance statement. The three C2 domains are reproduced from the two press articles above. File names and paths come from the same articles. No hash, cache-file size or scheduled-task name was published, so the pack ships a placeholder and behavioral hunts instead of invented values. Indicators from other ClickFix clusters mentioned in the sources are deliberately excluded.