⚠️ Security Warning

ClickFix lures can lead to malware and computer viruses. If you see text like this online, it's likely a scam.

Back to Techniques

Steganography ClickFix (Stego Loader)

An advanced ClickFix variant that uses steganography to hide malicious payloads within PNG images. The technique was documented in November 2025 and uses a .NET tool called "Stego Loader" to extract and execute the hidden payload. The attack flow: 1. ClickFix page tricks user into running initial PowerShell 2. PowerShell downloads an innocent-looking image (PNG/JPG) 3. Image contains AES-encrypted malware hidden in pixel data 4. Stego Loader extracts and decrypts the payload in memory 5. Malware (LummaC2, Rhadamanthys) executes without touching disk This technique evades traditional file-based detection since the malware is never written to disk as an executable.

windows browser Cache Smuggling Fileless Execution Local Execution Memory-only Malware PowerShell Service Worker Abuse Steganography

Image-based payload delivery

Try Example
Steganography PowerShell Fileless Execution Memory-only Malware

The ClickFix page instructs users to run a PowerShell command that downloads what appears to be an image file. The image contains the actual malware payload hidden using steganography techniques.

  1. User encounters ClickFix page (fake CAPTCHA, update, etc.)

  2. Runs PowerShell command that downloads .png/.jpg file

  3. PowerShell uses System.Drawing.Bitmap to extract pixel data

  4. Hidden payload is AES-decrypted in memory

  5. Malware executes entirely in memory (fileless)

References:

Mitigations:

  • Monitor PowerShell loading System.Drawing assembly

  • Detect GetPixel/LockBits calls on downloaded images

  • Block PowerShell downloading image files then processing them

  • Use AMSI to scan memory-resident payloads

Contributor: ClickGrab (2025-11-29)

Cache smuggling variant

Try Example
Cache Smuggling Service Worker Abuse Local Execution

A variant that uses browser cache smuggling. JavaScript caches a malicious file disguised as a JPG in the browser cache. The ClickFix command then executes the locally cached file without making additional network requests, evading network-based detection.

  1. User visits malicious page

  2. JavaScript uses Service Worker or Cache API to store payload

  3. Payload is disguised as image/media file

  4. ClickFix command references local cache path

  5. Execution happens without new network requests

References:

Mitigations:

  • Monitor Service Worker registrations

  • Audit browser cache for executable content

  • Detect ClickFix commands referencing local paths

Contributor: ClickGrab (2025-11-29)