Cache smuggling turns ClickFix phishing into a fileless delivery path

At a glance

What this is: This is an analysis of a ClickFix-style phishing campaign that uses cache smuggling to place a payload on disk without a visible download.

Why it matters: It matters because identity and endpoint teams need to recognise that social engineering can bypass download-based controls and still lead to privileged execution paths on managed systems.

By the numbers:

• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
• 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, with 46% confirmed and 26% suspected.

👉 Read Expel's analysis of cache smuggling in a ClickFix phishing campaign

Context

Cache smuggling is a delivery technique that abuses normal browser behaviour to stage malicious content locally without an obvious download event. In this campaign, the lure used a fake VPN compliance checker and a ClickFix-style paste-and-run flow, which is effective because it blends social engineering with file placement and execution on the endpoint.

The identity relevance is indirect but real. Enterprise VPN and remote access workflows create trusted user expectations, while endpoint controls, PowerShell policy, and browser telemetry become the main lines of defence when attackers avoid classic download signals. This is a phishing and endpoint execution problem rather than an NHI compromise, but the governance lesson is the same: trusted operational workflows can be weaponised.

The campaign is a fairly typical example of modern delivery tradecraft, even if the cache-smuggling mechanism is more unusual than the lure itself.

Key questions

Q: What breaks when attackers use cache smuggling instead of a normal file download?

A: Download-based detections lose visibility because the browser caches the payload through ordinary web behaviour, and the malicious script later extracts it locally. That means defenders must watch for cache access, archive extraction, and script execution together. If you only inspect network downloads, the delivery chain can look clean even when code is already on the endpoint.

Q: Why does ClickFix-style phishing remain effective against mature environments?

A: It succeeds because it targets user trust in familiar workflows such as compliance checks, support steps, or file verification. The user believes they are performing a harmless action, but the pasted content actually launches code. Mature environments still need controls that limit interpreter access, log suspicious shell use, and reduce the reach of browser-to-shell handoffs.

Q: How do security teams detect cache smuggling in practice?

A: Look for unusual reads from browser cache directories, script activity that immediately follows a browser interaction, and archive creation or extraction in user-writable paths. Correlate those signals with PowerShell or other interpreter launches. The useful signal is the chain, not any single event, because each step on its own can look legitimate.

Q: Who is accountable when phishing files lead to code execution?

A: Accountability usually spans email security, endpoint security, and the business owner of the exposed workflow. If a malicious attachment can reach a user and then create persistent execution, the control failure is shared across delivery, inspection, and host hardening. Frameworks such as CIS Controls and NIST SP 800-53 expect that shared boundary to be governed.

Technical breakdown

How cache smuggling uses the browser cache as a staging layer

Cache smuggling works by making the browser request content that appears harmless, often an image, so the browser stores it locally under normal caching logic. The payload is then recovered from that cache file by a later script, which means the attacker never has to issue a second download from the victim machine. That breaks many detections that rely on suspicious transfer events, malicious file hashes, or browser download telemetry. The important nuance is that the browser is not behaving maliciously. It is performing a legitimate caching function that the attacker has repurposed as a covert staging mechanism.

Practical implication: monitor for processes that read from browser cache directories and treat that behaviour as a delivery-stage alert.

ClickFix lures turn clipboard trust into code execution

ClickFix is a social engineering pattern that convinces the user to copy and paste a command into a system tool that will execute it, usually under the guise of verification or remediation. In this case, the page padded the clipboard text so the visible portion looked like a file path, while the hidden portion contained a PowerShell command. That matters because the user believes they are confirming something already present on the network, not launching a script. The technique exploits interface trust and user habituation, not a software vulnerability.

Practical implication: block or tightly constrain paste-and-run behaviours in environments where users can be induced to execute commands from a browser.

Why fileless delivery frustrates download-centric controls

Many endpoint and secure web gateway controls key on explicit file downloads, archive retrieval, or a process making outbound requests to fetch malware. Cache smuggling removes that obvious handoff. The malicious content arrives through a browser-managed cache write, then a local script extracts and launches it, often through PowerShell and legitimate system binaries. Detection therefore has to join together multiple weak signals, including browser cache access, suspicious PowerShell usage, and process ancestry. This is a delivery-chain problem, not just a malware-hash problem.

Practical implication: build detections across browser cache access, PowerShell invocation, and process lineage rather than relying on download events alone.

Threat narrative

Attacker objective: The attacker wants to achieve local code execution on a corporate endpoint while avoiding download-based detections and preparing the system for follow-on access.

1. Entry occurs through a phishing lure that imitates a VPN compliance checker and persuades the user to interact with a browser page.
2. Credential or payload access is achieved when the browser caches disguised content and a hidden PowerShell command extracts the payload from local cache files.
3. Impact follows when the extracted archive is expanded and the bundled executable runs on the endpoint, creating a foothold for further intrusion.

NHI Mgmt Group analysis

Cache smuggling is a delivery-evasion pattern, not just a curious trick. The key governance problem is that security stacks often assume malicious payloads must arrive through a visible download path. This campaign shows that assumption is too narrow because the browser cache can become an unmonitored staging layer. Practitioners should treat cache access as part of endpoint threat detection, not just a browser performance detail.

ClickFix works because it exploits interface trust, not technical vulnerability. The lure borrows the authority of a VPN compliance workflow and turns user help-seeking behaviour into execution risk. That makes user education necessary but insufficient on its own. Teams need controls that reduce the chance that a pasted command, especially one hidden behind a benign-looking file path, can reach PowerShell or an equivalent interpreter.

Browser cache visibility is now a detection requirement. The article adds another example of how normal operating system and browser functions can be repurposed for covert staging. This is where endpoint telemetry, PowerShell governance, and secure web gateway controls converge. The practitioner conclusion is straightforward: if your detections do not account for cache-driven delivery, you are leaving a blind spot in the attack chain.

Phishing defence has to include execution governance. Many organisations still treat phishing as an email or browser problem, but the actual risk materialises when the user can trigger scripting, archive extraction, or binary execution. That means policy around PowerShell, browser hardening, and process monitoring belongs in the same control conversation as URL filtering. The operational goal is to break the chain before the payload becomes executable.

What this signals

Cache-driven delivery increases the value of behavioural telemetry over static file reputation. When the payload arrives through a browser cache and is assembled locally, defenders need to see the sequence of browser activity, script invocation, and file materialisation. That is consistent with the direction of modern endpoint defence and with the broader NIST Cybersecurity Framework emphasis on detection and response. See the NIST Cybersecurity Framework 2.0 for the control model, then map browser cache visibility into your own detection engineering.

ClickFix raises a governance problem around user-initiated execution paths. Security teams often harden email, web filtering, and download controls separately, but this campaign shows how those layers can be bypassed by moving execution into the user workflow. The practical response is to treat script execution policy, browser hardening, and privilege management as one control domain rather than three disconnected ones.

Cache smuggling should be treated as an execution governance issue because it compresses the time between social engineering and code running on the host. That makes process-lineage review and interpreter control more important than chasing the original lure alone. If your programme cannot trace browser activity into local execution, it will struggle to explain or prevent this class of intrusion.

For practitioners

• Monitor browser cache access paths Alert on unexpected processes reading from Chrome or other browser cache directories, especially when the process ancestry includes PowerShell, archive utilities, or suspicious shells.
• Constrain PowerShell execution Restrict PowerShell to approved roles where possible, and where restriction is not feasible, apply script logging, constrained language mode, and strong process monitoring.
• Harden against paste-and-run lures Use user education and browser hardening to reduce successful ClickFix-style execution, especially on systems that provide remote access to corporate environments.
• Block newly seen malicious domains Use secure web gateways or DNS filtering to block newly created and newly observed domains, including lookalike compliance-check pages used in phishing lures.

Key takeaways

• Cache smuggling turns a browser feature into a local staging mechanism, which weakens controls that depend on visible downloads.
• The campaign combines social engineering, clipboard abuse, and PowerShell execution, so defenders need correlated telemetry rather than a single indicator.
• The most useful controls are browser cache monitoring, script governance, and filtering that blocks newly seen phishing domains before the user reaches the lure.

Key terms

• Cache Smuggling: A delivery technique that hides malicious content inside normal browser cache behaviour so a local script can recover it later. It replaces a visible download with legitimate caching, which makes transfer-based detection less reliable and shifts the defender’s focus to endpoint and process telemetry.
• ClickFix: A browser-delivered social engineering technique that persuades a user to paste and execute a malicious command, usually through clipboard manipulation and a fake instruction sequence. The key risk is that the endpoint may see a normal user action even though the payload originated from a hostile webpage.
• Clipboard Manipulation: The abuse of copied text to conceal a malicious command behind a harmless-looking snippet, often by padding or formatting the visible portion. It is effective because users inspect only what appears in the interface, not the full command that reaches the shell.
• Browser Cache Staging: The use of cached web content as a temporary holding area for payload components before local extraction and execution. This technique relies on ordinary browser behaviour, so the defender must inspect what processes touch the cache and what they do with the cached files next.

What's in the full article

Expel's full analysis covers the operational detail this post intentionally leaves for the source:

• The exact PowerShell command structure used to extract the payload from the browser cache and launch it locally.
• The page source and clipboard manipulation sequence that made the ClickFix lure look like a routine compliance check.
• The specific cache artefacts and regex pattern used to recover the embedded archive from the disguised image response.
• Defender guidance for spotting browser-cache abuse alongside the later signed-executable stage mentioned in the article.

👉 Expel's full post covers the cache extraction method, lure mechanics, and endpoint defence guidance.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, identity lifecycle, and secrets management in a way that helps security teams connect identity control to operational risk. It is designed for practitioners who need a stronger governance lens across access, privilege, and automation.