Picture This: ClickFix Hides Malware In An Image

What happened?

In a recent post on X, Microsoft Threat Intelligence highlighted an evolution of ClickFix in which a cluster of compromised websites concealed a malicious script within a PNG image file downloaded to the browser cache. Microsoft did not publicly attribute the campaign to a specific threat actor.

ClickFix attacks typically use a fake CAPTCHA, browser update or technical error to persuade users to copy and paste a supposed “fix” into Windows Run, PowerShell or another system utility. In this campaign, however, the initial payload is already present on the device - the PNG file acts as a carrier, with the visible image helping the file appear benign while the concealed script can be recovered from the browser cache and executed locally. The user-supplied command locates the cached file by its expected size, copies it to a temporary folder with a Visual Basic Script (.vbs) extension and executes it. Once running, the script gathers device information, retrieves