TL;DR: A ClickFix-style phishing campaign uses cache smuggling to stage a payload through the browser cache instead of an explicit download, which can evade tools that focus on file retrieval and web requests, according to Expel. The pattern matters because it shifts detection toward clipboard abuse, PowerShell execution, and unusual cache access rather than network-based indicators.
At a glance
What this is: This is a phishing campaign analysis showing how cache smuggling turns a ClickFix lure into a fileless delivery path by hiding the payload in browser cache data.
Why it matters: It matters because defenders that rely on file download telemetry or network-request alerts can miss the delivery path, so endpoint, browser cache, and script execution controls become more important.
Context
Cache smuggling is a delivery technique, not a new exploit class: it abuses normal browser caching behavior to place attacker-controlled content on disk without an obvious download event. In this campaign, that matters because the lure is built around remote access and VPN compliance, a context where users are already primed to trust administrative-looking prompts.
The governance problem is that detection logic often assumes a payload must arrive through a visible file transfer or a direct web request. Here, the fileless chain still produces an endpoint execution event, but the staging happens through browser cache abuse and clipboard manipulation, which means identity and endpoint defenders need to watch the user interaction layer as well as the process layer.
Key questions
Q: What breaks when attackers stage payloads through browser cache instead of downloads?
A: Download-based detection breaks first, because the browser may only handle content that looks like a benign web object while the payload is later reconstructed from cache on the endpoint. Teams then need telemetry around browser cache access, script execution, and process lineage rather than relying on file-transfer events alone.
Q: Why does a ClickFix lure increase endpoint execution risk in remote access workflows?
A: ClickFix succeeds because it turns the user into the execution mechanism. In remote access contexts, compliance checks and VPN prompts look operationally normal, so a pasted command can appear legitimate enough to bypass suspicion. That makes user education and script control part of access governance, not just security awareness.
Q: How do security teams detect cache smuggling in practice?
A: Look for unusual reads from browser cache directories, script activity that immediately follows a browser interaction, and archive creation or extraction in user-writable paths. Correlate those signals with PowerShell or other interpreter launches. The useful signal is the chain, not any single event, because each step on its own can look legitimate.
Q: Should organisations restrict PowerShell or focus on web filtering first?
A: Do both, but prioritise PowerShell restriction where the business can tolerate it, because the final impact depends on script execution. Web filtering reduces exposure to the lure, while script controls reduce the chance that a successful lure becomes endpoint compromise. The strongest programmes treat both as complementary controls.
Technical breakdown
How cache smuggling stages payloads through browser storage
Cache smuggling uses a browser feature that is normally benign: temporary local storage of web content for performance. The attacker serves malicious bytes as content that looks like an image, the browser caches it, and later script on the host extracts the hidden payload from cache files. Because the malware does not need to download the payload itself, network-based controls may never observe the final artifact moving over the wire. The important point is that the cache becomes an untrusted staging area, and that changes what telemetry matters.
Practical implication: Monitor for unusual processes reading browser cache directories and treat cache access as a staging signal, not just a performance artifact.
Why ClickFix lures work so well in remote access contexts
ClickFix campaigns rely on social engineering rather than exploit chains. The user is told to paste a command into a familiar interface, often under the guise of a compliance check or setup step, and the command executes with the user’s own privileges. In this case, the lure impersonates a VPN compliance checker, which is plausible because remote access workflows already involve administrative prompts and support scripts. That makes the human approval step the delivery mechanism, not a supporting detail.
Practical implication: Restrict PowerShell where possible and train users to treat copy-paste execution prompts as a control boundary, especially for remote access themes.
Why cached payloads bypass download-centric detection
A cached payload can evade controls that are tuned to scan browser downloads, block suspicious attachments, or look for direct web retrieval in script content. The browser may only see an innocuous response labeled as an image, while the PowerShell command later reconstructs the real archive from cached bytes and executes it. This is a control mismatch problem: the content path is present, but the detection model expects a conventional download lifecycle that never happens. Endpoint execution remains visible, but the staging path is not.
Practical implication: Correlate browser cache activity with script execution and web filtering so your telemetry can catch nontraditional payload staging.
Threat narrative
Attacker objective: The attacker wants to execute malicious code on a corporate endpoint while bypassing detection rules that depend on visible downloads or obvious script-to-web activity.
- Initial access begins with a phishing page that impersonates a Fortinet VPN compliance checker and persuades the user to paste attacker-controlled text.
- Credential or payload staging happens when the browser fetches disguised content, caches it locally, and the hidden command reconstructs the payload from that cache.
- Execution occurs when the user-triggered PowerShell command extracts the cached archive and launches the embedded executable.
- Impact is achieved by placing malicious code on the endpoint through a delivery path that avoids explicit downloads and web-request telemetry.
Breaches seen in the wild
- CitrixBleed 2 2025: CitrixBleed 2 leaked NetScaler session tokens from memory, letting attackers hijack VPN sessions and skip MFA at 100+ organisations.
- SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Cache smuggling creates a new governance gap between browser behavior and endpoint detection. Security teams often instrument file downloads, attachment scanning, and web requests, but cache-based staging sits between those layers. That makes the browser cache a control boundary, not just a storage detail. Practitioners should treat hidden staging in cache files as a first-class detection problem, especially where PowerShell execution can occur on the same host.
ClickFix remains effective because users are still the execution gate. The lure does not need a software vulnerability if it can persuade a user to paste and run a command. In identity and access programmes, that means the trust model for support flows, VPN checks, and compliance prompts has to be tighter than the surrounding user experience. Security teams should assume attacker content will borrow the language of remote access administration.
Remote access branding is a strong deception vector because it aligns with legitimate operational behaviour. The article’s fake VPN checker works because users expect VPN-related prompts to involve files, scripts, or troubleshooting steps. That creates a high-value social engineering pattern for environments where remote work is normal. The practical conclusion is that remote access workflows need stricter guardrails, clearer user guidance, and stronger monitoring for suspicious browser-to-shell transitions.
Cache smuggling is a fileless delivery path, but not a control-less one. The technique does not remove the need for endpoint execution, browser activity, or web hosting. It simply shifts where defenders have to look. Security programmes that combine browser cache telemetry, constrained scripting, and egress filtering will be better positioned than teams that only watch for downloaded malware.
What this signals
Cache smuggling is a telemetry mismatch problem. Defenders that only hunt for obvious downloads will miss payloads that arrive through browser cache, so browser-to-shell transitions deserve the same attention as file writes. The control lesson is simple: if the browser can stage content, the browser becomes part of the attack surface.
Remote-access themed lures are especially effective because they borrow legitimacy from everyday operational behaviour. That creates a governance issue for identity and access teams as much as for endpoint teams, because users are being manipulated at the moment they believe they are following a support or compliance process.
The practical response is to tighten scripting authority, monitor browser cache access, and filter newly seen domains together rather than as isolated controls. A single control will not close the gap if the delivery path is designed to bypass the assumptions behind that control.
For practitioners
- Alert on browser cache access by unexpected processes Create detections for PowerShell, command shells, and other non-browser processes reading or copying Chrome cache directories, especially when followed by script execution.
- Constrain PowerShell on standard user endpoints Use application control or policy-based restrictions so routine users cannot execute PowerShell for ad hoc troubleshooting or copy-paste workflows.
- Block newly seen domains used in remote access lures Tune DNS filtering and secure web gateway rules to block newly created or newly observed domains that impersonate VPN or compliance tooling.
- Train users to distrust copy-paste execution prompts Add targeted awareness content for ClickFix-style lures so users recognize that a prompt to paste text into a shell or explorer bar is a security event, not a support step.
Key takeaways
- Cache smuggling shifts phishing from obvious file delivery to hidden browser-staged content, which weakens download-centric detection models.
- The campaign’s Fortinet VPN compliance checker lure shows how remote access branding can make copy-paste execution look routine to users.
- Defenders need visibility into browser cache access, constrained scripting, and domain filtering together if they want to reduce this attack path.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0001;TA0002;TA0006;TA0008 — Initial Access; Execution; Credential Access; Lateral Movement | The campaign uses phishing entry, user-triggered execution, and staged payload delivery. |
| Recommendation — Map the lure, execution chain, and cache staging to ATT&CK and hunt for browser-to-shell transitions. | ||
| NIST CSF 2.0 | DE.CM-09 — Monitoring for Unauthorized Personnel, Connections, Devices and Software | Unexpected browser cache access and script execution are monitoring signals, not isolated events. |
| Recommendation — Add cache-access telemetry to your monitoring programme and correlate it with endpoint execution. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | The article’s detection advice depends on logging process activity around cache and PowerShell use. |
| Recommendation — Log cache-directory access and PowerShell execution so suspicious staging can be investigated quickly. | ||
| NIST SP 800-53 Rev 5 | SI-4 — System Monitoring | System monitoring is the control family that captures suspicious cache access and script execution behavior. |
| Recommendation — Use SI-4 to monitor browser cache access, shell spawning, and other anomalous endpoint behavior. | ||
Key terms
- Cache Smuggling: A delivery technique that hides malicious content inside normal browser cache behaviour so a local script can recover it later. It replaces a visible download with legitimate caching, which makes transfer-based detection less reliable and shifts the defender’s focus to endpoint and process telemetry.
- ClickFix: A browser-delivered social engineering technique that persuades a user to paste and execute a malicious command, usually through clipboard manipulation and a fake instruction sequence. The key risk is that the endpoint may see a normal user action even though the payload originated from a hostile webpage.
- Browser Cache Staging: The use of cached web content as a temporary holding area for payload components before local extraction and execution. This technique relies on ordinary browser behaviour, so the defender must inspect what processes touch the cache and what they do with the cached files next.
- Clipboard Abuse: An attack method that manipulates copied text so what the user sees is not the full command that will execute. In phishing and ClickFix scenarios, clipboard abuse is used to hide malicious syntax behind a benign-looking file path or operational instruction.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore the course if your programme needs a stronger bridge between identity controls and operational security decisions.
Published by the NHIMG editorial team on August 20, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org