Microsoft uncovers new variant of ClickFix cache‑smuggling attack

Microsoft has reported a new variant of the ClickFix cache‑smuggling attack, a technique that allows threat actors to extract malicious code from a victim’s browser cache without needing to reference the original URL. The finding was highlighted in a recent iTnews Australia report.

The method relies solely on the file size of cached objects. By sending a request that matches the exact size of a previously cached file, an attacker can cause the browser to return the cached payload, effectively “fishing” the malware out of the cache. This bypasses many traditional detection mechanisms that focus on URL or content signatures.

For organisations in Australia, the discovery raises concerns for both corporate networks and government agencies that depend on web‑based applications. The attack can be launched from any compromised site, making it difficult to block at the perimeter, and it underscores the need for robust endpoint protection and regular browser updates.

Microsoft advises administrators to ensure browsers are patched to the latest versions, to enable strict cache‑control headers, and to monitor for anomalous cache‑access patterns. Security teams should also consider employing network‑level inspection tools that can detect unusual request sizes.

Australian IT professionals looking to strengthen their defensive skills may find value in up‑to‑date security training; Wepro Technology in Darwin offers courses such as CompTIA Security+ that cover modern threat vectors and mitigation strategies.