A newly reported ClickFix technique is using compromised websites to place a malicious payload in a visitor's browser cache before the user is prompted to run it. According to Microsoft Threat Intelligence, the payload is disguised as a PNG file and cached by the browser, rather than being downloaded in the more obvious way seen in many traditional attacks.

The development is relevant for European businesses because it shows how attackers are adapting common website compromise and social-engineering methods to get around basic execution restrictions on Windows systems. For organisations that rely on web applications, SaaS platforms, browser-based workflows and non-technical staff, this raises the risk that an ordinary browsing session could become part of a malware delivery chain.

What happened

Microsoft Threat Intelligence said a new form of ClickFix attack uses compromised websites to trick users into executing a malicious payload that has already been placed in the browser cache. The reported technique differs from more typical patterns in which malware is downloaded and launched directly from a remote location.

In this case, the site first pre-fetches the payload into the browser cache while disguising it as a PNG image. The apparent goal is to make the malicious file look less suspicious and to help the attack bypass some limits associated with standard Windows Run-based execution flows.

Based on the information provided, this is a reported attack method rather than a new product vulnerability announcement. The source does not provide further technical detail here on affected browser versions, Windows configurations or the full infection chain.

Why it matters for European businesses

This technique matters because it combines several risk factors businesses already face: compromised websites, user deception, browser trust and file execution on employee devices. Many organisations still focus security controls on email attachments and direct downloads. A payload that is staged through the browser cache may be harder for users to recognise as malicious.

For SMEs in particular, the practical issue is that employees routinely visit supplier portals, CMS back ends, e-commerce dashboards and third-party business websites during normal work. If one of those sites is compromised, an attacker may not need a traditional phishing email to start the attack chain.

The technique is also significant for IT and security teams because browser-based delivery methods can blur the line between web security, endpoint protection and user awareness. Detection strategies built mainly around downloaded executable files may need to be reviewed if attackers increasingly hide payloads inside normal-looking web traffic and cached content.

Who may be affected

• SMEs and founders whose teams use Windows endpoints and web-based tools extensively
• Marketing and e-commerce teams that frequently access third-party platforms, ad tools, storefront systems and supplier websites
• IT teams and managed service providers responsible for browser security, endpoint controls and web filtering
• Digital agencies and web operators that manage multiple client websites and could face risk from site compromise
• Businesses with limited security monitoring that may not detect unusual browser-cache-based activity quickly

What companies should consider

• Review browser and endpoint protections. Check whether security tools can inspect or detect suspicious activity involving cached browser content, script execution and unusual file handling.
• Strengthen website security. Since the technique relies on compromised websites, keep CMS platforms, plugins, themes and server components updated and monitored.
• Reinforce user guidance. Train staff to be cautious if a website asks them to run commands, paste code, open system tools or follow unusual verification steps.
• Harden Windows execution paths. Assess policies around script execution, command-line tools and user permissions to reduce the impact of social-engineering-based malware delivery.
• Improve web monitoring. Use logging, threat detection and DNS or web filtering controls to spot suspicious site behaviour or known malicious infrastructure.
• Prepare incident response steps. Make sure teams know how to isolate an affected endpoint, preserve logs and investigate whether the source was a compromised business website rather than email.

While the currently available details are limited, the reported method is a useful reminder that malware delivery is increasingly tied to normal browser activity. For European businesses, that means web security, endpoint security and staff awareness need to work together rather than being treated as separate issues.