BROWSER CACHE SMUGGLING: THE RETURN OF THE DROPPER

Summary from the TLDR InfoSec newsletter

The Browser Cache Smuggling attack enables attackers to drop malicious DLLs into a browser's cache, which can be moved to vulnerable directories such as Microsoft Teams' localappdata folder. Attacks use a DLL proxy technique to execute malware through legitimate applications while forwarding API calls to the original DLL. To defend against this, organizations should restrict scripting engines like PowerShell, avoid localappdata installations, configure browsers to clear their cache on exit, and set detection rules to alert when non-browser processes access cache files.