Author | Lightnews

Cache smuggling: When a picture isn’t a thousand words

Reposted by Expel

Marcus Hutchins @malwaretech.com · 14d

We encountered a unique variant of the ClickFix malware technique. The catch? The user is social engineered into running a PowerShell script which downloads no files, makes no web requests, and embeds no payload.

Regardless, it's still able to install a malicious loader.

expel.com/blog/cache-s...

We recently observed an innovative campaign using the ClickFix attack tactic for cache smuggling. Here's what you need to know.

Cache smuggling: When a picture isn’t a thousand words

6 14 66

Expel @expelsecurity.bsky.social · 14d

This technique isn't widespread yet but we've seen it before. Part 2 drops soon; we'll show you how attackers abuse a legitimate signed executable to load highly evasive shellcode.

Full analysis by Marcus Hutchins (@malwaretech.com), Principal Threat Researcher: expel.com/blog/cache-s...

We recently observed an innovative campaign using the ClickFix attack tactic for cache smuggling. Here's what you need to know.

Expel @expelsecurity.bsky.social · 14d

Defense recommendations:
→ Alert on unexpected processes touching browser cache
→ Restrict PowerShell to users who need it
→ Monitor for suspicious PowerShell execution patterns
→ Block newly created/newly seen domains
→ Educate users on ClickFix social engineering

Expel @expelsecurity.bsky.social · 14d

This bypasses a lot of security tools:
• No explicit file downloads to scan
• No PowerShell web requests to flag
• Just an "image" getting cached (normal behavior) and a script reading local files (also normal)

Simple. Effective. Evasive.

Expel @expelsecurity.bsky.social · 14d

The webpage fetches what claims to be an image (Content-Type: image/jpeg). Browser dutifully caches it.

Open it in a hex editor? No JPG header. Just a zip archive wrapped in those magic strings, sitting in your cache waiting to be extracted.

Expel @expelsecurity.bsky.social · 14d

Here's where it gets interesting: The PowerShell script doesn't download anything. It searches your browser's cache for data wrapped between two strings: "bTgQcBpv" and "mX6o0lBw"

That data? A zip file the page already smuggled into your cache as a fake JPG.

Expel @expelsecurity.bsky.social · 14d

When you click "Open File Explorer," it copies what looks like a harmless file path to your clipboard:

\Public\Support\VPN\ForticlientCompliance.exe

But 139 spaces are hiding a PowerShell command above it that your eyes never see.

Expel @expelsecurity.bsky.social · 14d

The lure pretends to be a Fortinet VPN Compliance Checker. Makes sense. Fortinet's VPN is used by enterprises so compromising it means access to corporate networks.

The page looks unassuming. The command doesn't.

Expel @expelsecurity.bsky.social · 14d

⚠️ Our threat intel team just caught attackers using a clever new trick to bypass security tools: cache smuggling.

Instead of downloading malware, they hide it in fake images that browsers automatically cache. Then PowerShell extracts and runs it—no web requests needed.

Expel Intel | Cybersecurity threat intelligence

Expel @expelsecurity.bsky.social · 14d

This evolution builds on our foundation of integrating actionable threat intel into daily operations. We’re accelerating our capabilities, dedicating expert resources to surface context that benefits customers and the security community.

Learn more: expel.com/intel
(7/7)

Expel’s dedicated threat intelligence team and program, transforming real-world incident findings into actionable defense strategies.

Cache smuggling: When a picture isn’t a thousand words

2

Expel @expelsecurity.bsky.social · 14d

We're also bringing @malwaretech.com into the mix. Marcus’ expertise in malware analysis and reverse engineering adds serious firepower to our ability to understand and counter evolving threats. 👀 Read his first blog post with Expel: expel.com/blog/cache-s...
(6/7)

We recently observed an innovative campaign using the ClickFix attack tactic for cache smuggling. Here's what you need to know.

1 1 15

Expel @expelsecurity.bsky.social · 14d

Our threat intelligence isn't academic. It’s built by operators, for operators. We share what we learn from stopping real attacks. The community gets stronger when we all learn from the same adversaries.
(5/7)

Expel @expelsecurity.bsky.social · 14d

Our approach: When our SOC identifies threats across customer environments, Expel Intel digs deeper, documents what matters, and publishes the findings. When zero-days emerge, we hunt and share results. When attack patterns shift, we explain what's happening and what to do.
(4/7)

Expel @expelsecurity.bsky.social · 14d

For years, our threat intel team has been behind the scenes turning real incidents into actionable defense strategies for our customers. We're expanding our focus to share what we're learning with the broader security community.
(3/7)

Expel @expelsecurity.bsky.social · 14d

You’ve likely seen some of our work.

👉 Added clarity around a specific trojan (ManualFinder): www.reddit.com/r/cybersecur...
👉 Distinguished BaoLoader from other malware via code-signing certificates: expel.com/blog/the-his...
👉 Investigating Latrodectus malware: x.com/ExpelSecurit...
(2/7)

1 1

Expel @expelsecurity.bsky.social · 14d

The security industry is drowning in threat feeds that don't actually help you stop attacks. We've been working to fix that for years.

Today, we’re taking the wraps off our expanded threat intel program: Expel Intel.
(1/7)

Stories from the SOC: When threats come from inside the house

Expel @expelsecurity.bsky.social · 20d

50k events/day. 0.1% true positive rate. 50 real threats buried.

That's what happens when you optimize for integration count, not detection quality. Vendors brag about "300+ integrations" while analysts burn out investigating false positives.

Start counting what matters: expel.com/blog/stop-co...

Expel @expelsecurity.bsky.social · 23d

While traditional tools may not tell the difference between a user who is compromised and one who isn’t, Expel MDR for Email can. Our email MDR coverage correlates unusual login locations, suspicious contacts, and deleted emails. Learn more: expel.com/blog/stories...

MDR email coverage is more than just flagging spam to contain threats. Here's what happens when malicious emails come from within an org.

Expel @expelsecurity.bsky.social · 23d

Your email gateway is designed to catch threats from outside. But when attackers compromise a legitimate employee account and send phishing emails internally, most detection tools fail. Internal phishing is harder to detect because the senders are trusted.

1 1

Expel @expelsecurity.bsky.social · 23d

Your email security quarantined the malicious email. 🚨📧 Victory, right?

Not quite so. Several employees already clicked the link and installed attacker-controlled tools.

Gonzo threat hunting: LapDogs & ShortLeash

Expel @expelsecurity.bsky.social · 27d

We immediately alerted customers and reported findings to the Department of Energy.

Full analysis with IOCs: expel.com/blog/gonzo-t...

Follow along as a senior detection & response engineer locates threat actors using SOHO devices & ORB networks, Gonzo-style.

Expel @expelsecurity.bsky.social · 27d

We took public threat intelligence about "LapDogs" malware, ran it through our customer environments, and discovered compromised home routers connecting to corporate networks including devices belonging to critical infrastructure employees.

1 1

Expel @expelsecurity.bsky.social · 27d

Chinese threat actors were building a network of SOHO routers and marking their territory with TLS certs that spoofed the LAPD.

Our threat hunters found them anyway. 🕵️

You don’t find ManualFinder, ManualFinder finds you

Expel @expelsecurity.bsky.social · Aug 22

⚠️ We’ve recently witnessed new activity in the realm of potentially unwanted programs (PUPs), which are dropping malware, executing commands, and turning your machine into someone else's proxy network.

Read our ongoing investigation here: expel.com/blog/you-don...

We're investigating ManualFinder, a trojan malware we're seeing in new activity, likely coming from potentially unwanted programs (PUPs).