ClickFix cache smuggling: Run-dialog command that runs a payload hidden in the browser cache — page code

Fake verification overlays on compromised websites (a Cloudflare-style 'Verifying…' box that tells the visitor to press Windows key + R, paste with Ctrl+V and press Enter) whose copied command contains no web address. Before the visitor does anything, the page loads the real payload, a VBScript or batch file, as if it were an image, so the browser stores it in its cache. The pasted cmd.exe one-liner walks the browser profile folder (for /r over %LOCALAPPDATA%), picks the cached file by its exact size (if %~zf==33433) or by a marker string inside it (findstr /m /c:), copies it to %TEMP% under a script name such as t.vbs or t.cmd, and runs it. Reported by Microsoft Threat Intelligence on 2026-10-03: the VBScript fetches a PowerShell stage from cocojambo[.]us[.]com, which leads to credential theft and a Python backdoor contacting capsysnet[.]vg and ciliabula[.]cc. Expel and Crimson7 described the same technique earlier. No legitimate verification step asks visitors to run a command.