securitytabs

Browser Cache Payloads

MentionsMicrosoftMicrosoft Windows

Plays from YouTube in privacy-enhanced mode — nothing loads from YouTube until you press play.

This ClickFix technique stages the next payload through the browser cache, leaving a batch script on the file system before the user runs a command through the Windows Run dialog. I take a closer look at how the payload is retrieved and examine the website's network traffic, including requests that contain the browser's user agent. Watch the full video: https://youtu.be/oJHOlNTH7lY?si=8LruOkxZlfvFLII-

Description from John Hammond.

More in Threat Intel