ClickFix Cache Smuggling: Shell Commands Hidden in PNG Palettes

In early September 2026, Vega investigated a ClickFix incident on two customer workstations whose users visited the same compromised WordPress website and pasted an attacker-supplied command into the Windows Run dialog. Successful extraction and execution on the customer workstations were not confirmed, and the exact cached object tied to the incident was not recovered. Follow-up research in sandbox sessions against the same delivery infrastructure recovered a PNG image carrying a readable Windows shell command in its color palette, staged through ordinary browser traffic ahead of the paste. Apart from the command recorded in the customers' Run history, the delivery chain described below comes from those sandbox sessions, not from the customer workstations.

The attack starts when a user browses to a compromised website. The site served a JavaScript loader, either from a same-origin cache path or directly from external attacker infrastructure, and the loader talked to gating endpoints through the site's own domain or external servers. Before showing the lure, the loader collected browser fingerprints covering automation indicators, browser properties and rendering characteristics, and completed a proof-of-work challenge issued by the gate. Accepted visitors received a counterfeit Cloudflare verification page instructing them to open the Run dialog, paste the clipboard contents and run them. In the background, before the verification click, the loader fetched the PNG carrier, and the recovered responses carried long-lived cache headers.

The command recorded in the customers' Run history contained no download URL and no PowerShell. It recursively walked the local application data directory for files above a size threshold, searched each one with findstr for a campaign marker, and passed any matching line to a minimized command shell with delayed variable expansion enabled. The recovered PNG is an indexed-color image whose palette chunk holds a command that uses curl to retrieve text from a PDF-named URL, accumulates the returned lines into a variable, runs the result through a second command shell, and ends with its own marker string. The marker and file size in the recovered PNG differ from those in the customer command, so the two are not a confirmed pair. Byte-identical copies of the PNG were delivered in five responses across four sandbox captures, through the compromised site's same-origin path and several external endpoints.

Related sandbox captures showed alternative clipboard commands that download a batch script directly from attacker domains, followed by a request for an archive. A separate capture recovered a short batch script served under a PDF name that runs systeminfo, joins the output into a single variable, posts the host profile to an attacker endpoint, and executes any lines the server returns as commands. In the observed exchange the server returned an empty 404, and no follow-on payload or hands-on activity was seen. A later capture showed the same loader mechanics on rotated gate domains with modified API paths, an added verification widget, and batch-script retrieval from another domain, alongside binary downloads and network exchanges consistent with agent check-ins.