Affected Systems

Windows systems with Firefox and other browsers; users targeted via compromised websites and phishing lures. No specific product vulnerability—relies on social engineering to execute cached VBScript payloads that deploy credential-stealing .NET assemblies.

Exploitation Status

Active exploitation confirmed by Microsoft Threat Intelligence (October 2026). Multiple variants observed in the wild. PoC techniques publicly documented since August 2025. Phishing kits (e.g., IUAM) commoditize attack creation. CrowdStrike reports 563% increase in fake CAPTCHA lures in 2025.

Business Impact

Attackers bypass Windows Run character limits (260 chars) and evade traditional payload download detection by pre-staging malicious VBScript in browser cache as fake PNG files. Victims manually execute commands via social engineering (fake CAPTCHAs, error prompts), leading to credential theft from browsers and devices. Attack chain uses WMI reconnaissance, multi-stage PowerShell loaders, and process injection (timeout.exe) to establish persistence and C2 (cocojambo.us.com, capsysnet.vg, ciliabula.cc). No CVE—purely social engineering vector. AI summarization tools in email clients and productivity platforms can be exploited to inject ClickFix instructions via invisible prompt injection.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Block outbound connections to known ClickFix C2 domains: cocojambo.us.com, capsysnet.vg, ciliabula.cc at perimeter firewalls and DNS filters.
  • Monitor Windows event logs for wscript.exe launching VBScript from %LOCALAPPDATA%\Temp\ and cmd.exe recursively enumerating browser profile folders (%LOCALAPPDATA%\Mozilla\Firefox\Profiles, Chrome cache paths).
  • Deploy endpoint detection rules for PowerShell spawning from wscript.exe, process injection into timeout.exe, and .NET assembly loading from non-standard paths.
  • Conduct user awareness training on ClickFix social engineering: never paste commands from websites into Windows Run (Win+R), PowerShell, or Terminal, especially from fake CAPTCHA or error prompts.
  • Restrict execution of wscript.exe and cscript.exe via application control policies (AppLocker, Windows Defender Application Control) for non-administrative users where operationally feasible.