Ransomware locking your browser cache: how Aussie users can respond

When a ransomware strain finds its way onto a Windows or Mac machine, it usually goes straight for documents, images, and databases. A less talked about tactic involves encrypting the browser cache, the temporary files, cookies and saved snippets that Chrome, Edge or Firefox quietly store on your hard drive. Attackers realise that for many households these folders contain session tokens, banking receipts, downloaded statements and small but valuable business files, so locking them up creates leverage for a ransom demand.

Across Australia, where the National Broadband Network powers most households and online banking through institutions like CommBank, ANZ and Westpac is part of daily life, the loss of cached data can be deeply disruptive. A user in Melbourne logging in to MyGov after hours, or a small business owner in Brisbane uploading invoices through a web portal, can suddenly find their browser frozen with a ransom note demanding payment in cryptocurrency.

How browser cache encryption actually works

Browser caches live in specific directories such as Chrome's Default folder under AppData, Edge's Cache_Data directory, or Firefox's cache2 entries. Malware locates these folders, scans them for recognisable file types like PDFs, HTML snapshots and JavaScript bundles, then applies the same AES or RSA routines used on ordinary documents.

Because cache entries are technically temporary, many antivirus products have historically excluded them from real-time scanning. Threat actors exploit this gap. Some strains, often labelled cache lockers, append a custom extension and overwrite the original entries with encrypted blobs, while leaving a ransom message in the browser's default download folder or replacing the homepage.

Warning signs that your cache has been compromised

The first clue is usually behavioural. Your browser may refuse to load previously visited sites, display a 404-style page even for bookmarks, or pop up a full-screen ransom note the moment you open it. Session restoration fails, tabs that were open before the attack show a spinning loader, and downloads stall without explanation.

In Australia, several incidents reported through the ACCC's Scamwatch service describe users in Sydney and Adelaide seeing a fake system-update warning that turned out to be a browser locker. Logged-in services like Outlook, Xero or even the Australian Taxation Office portal may log users out automatically, because the session cookies sitting in the encrypted cache can no longer be read by the browser. Cache-locking crews frequently piggyback this attack with banking-focused keyloggers, and you can learn more about that pattern in the guide on removing spyware that records your keystrokes only when banking sites are open.

Immediate steps to contain the damage

Disconnect from the internet straight away. Pulling the network cable or switching off Wi-Fi prevents the ransomware from communicating with its command server and stops any further files in the cache from being encrypted. Next, terminate all browser processes through Task Manager on Windows or Activity Monitor on macOS so the malicious page cannot trigger additional payloads.

Avoid restarting the machine multiple times, as some strains save encryption keys only in volatile memory. Photograph the ransom note, note the file extensions added, and check whether any other folders beyond the cache have been touched. This evidence helps if you later decide to report the incident to ReportCyber or contact a technician.

Tools and methods for cache recovery

There is no universal decryptor for cache encryption, but several recovery avenues exist. Browser databases such as Chrome's History, Cookies and Top Sites use SQLite, so even when cache files are scrambled, the underlying databases may survive if they were stored in a different folder. Tools like DB Browser for SQLite can sometimes pull readable entries from these intact files.

Shadow copies and File History offer another path. Australians running Windows 10 or 11 with default settings often have restore points that pre-date the attack. Booting into Safe Mode and running vssadmin list shadows can reveal older snapshots of the cache directories. For Mac users, Time Machine remains one of the most reliable recovery routes, provided the backup drive was not left connected during the infection.

Cleaning residual malware from the system

The encryption itself is only one layer. Most cache-locking ransomware also drops a loader or a covert miner to keep generating income. Run a full scan with a reputable antivirus, then follow up with a dedicated anti-malware tool to catch anything the first pass missed.

You should also scan for GPU abuse, since several recent strains double as stealth miners and quietly siphon processing power. A useful walkthrough on removing a cryptominer that uses your GPU without permission explains how to spot runaway graphics usage, a strong indicator when a cache locker appears to be doing more than it should.

Restoring browser data safely afterwards

Once the system is clean, resist the temptation to import an old profile straight back in. Cached credentials may have been harvested during the attack, so resetting passwords through the genuine banking and email portals is essential. Australian banks rarely ask customers to re-enter card details through email links, so treat any prompt of that kind as suspicious.

Reinstall the browser from the official vendor rather than copying the old cache back. Import only bookmarks from a known-clean backup, then re-enable two-factor authentication on services such as MyGov, ATO, and any retail platforms. Clearing the remaining cache after a few days of use gives the new installation a clean baseline.

Preventing future cache-locking incidents

Good habits reduce the chance of facing this again. Keep browsers updated, disable automatic download of files from unfamiliar sites, and consider running a standard user account for daily browsing rather than an administrator profile. Backing up browser profiles to an external drive that is disconnected after each session limits what an attacker can hold hostage.

For ongoing protection and updates on emerging threats, you can also visit the main site for fresh advisories and removal guides. Australian households should review the Australian Cyber Security Centre's Essential Eight guidance and subscribe to Scamwatch alerts for a local layer of awareness. The combination of clean backups, current software and a cautious approach to unexpected downloads is the most reliable shield against cache-focused ransomware variants.