A new FileFix social engineering attack uses cache smuggling to covertly download malicious ZIP files, bypassing security measures. The attack impersonates a Fortinet VPN compliance check to trick users into executing hidden PowerShell commands. #FileFix #CacheSmuggling #ThreatActors #FortinetVPN
Keypoints
- The attack leverages fake phishing pages mimicking legitimate network verification prompts.
- It exploits browser cache smuggling to load malicious files without direct web requests.
- PowerShell scripts are hidden within padded clipboard content to evade detection.
- Threat actors are adopting this technique rapidly for ransomware and info-stealer campaigns.
- The new ClickFix generator enables easy creation of spoofed verification and lure pages.