Innovative FileFix Phishing Attack Proves Plenty Potent

Innovative FileFix Phishing Attack Proves Plenty Potent

Summary

This article from Dark Reading describes a sophisticated, globe-spanning phishing campaign built on the recently publicised FileFix technique. Attackers have rapidly weaponised FileFix—an evolution of ClickFix—using convincing brand impersonation (notably Facebook/Meta), heavy code obfuscation, and steganography to smuggle additional payloads inside images. The final payload often deploys StealC, a commercial infostealer that harvests credentials and sensitive data from browsers, wallets and enterprise apps.

Key Points

• FileFix tricks users into pasting a malicious path into File Explorer’s address bar, which executes PowerShell code.
• The current campaign is highly customised and translated into at least 16 languages, with samples seen worldwide.
• Attackers combine obfuscation and steganography: a downloaded JPG carries a second PowerShell script hidden inside it.
• The hidden final payload frequently installs StealC, which targets browsers, crypto wallets, VPNs and cloud credentials.
• Phishing lures impersonate account-security notices to pressure victims into following the steps quickly.
• FileFix may reach more targets than ClickFix because it leverages the familiar File Explorer rather than the Run dialog, which many organisations restrict.
• Defenders may need to update awareness training and apply technical controls that block execution via Explorer address bar and detect steganographic payload delivery.

Content Summary

The FileFix technique, published as a proof of concept in mid-2025, copies PowerShell to a victim’s clipboard and prompts them to paste it into File Explorer’s address bar under the guise of opening a provided file. Once executed, the PowerShell downloads an image that hides a secondary script via steganography; that script drops StealC, which exfiltrates passwords and high-value credentials. Acronis researchers have observed a mature campaign using this chain, with translations and VirusTotal submissions showing global distribution.

Context and Relevance

FileFix is notable because it converts an everyday user action—pasting a path into Explorer—into a remote code execution vector. Unlike Run-dialog methods that many organisations block, FileFix uses a more familiar UI element, widening the potential target set. The use of steganography and AI-generated images to conceal payloads demonstrates attackers combining multiple evasion techniques to bypass detection and user suspicion. For security teams, this means both security awareness programmes and endpoint controls need to catch up quickly.

Why should I read this?

Short answer: because this attack is sneakier than most and already global. Read it to spot the tiny changes attackers are relying on—paste-to-Explorer, images that aren’t just pictures, and social-engineering that leans on fear. We’ve cut the waffle and pulled out the parts you actually need to act on: patch awareness training, block or monitor execution from Explorer’s address bar, and look for steganographic downloads.

Source

Source: https://www.darkreading.com/cyberattacks-data-breaches/innovative-filefix-attack-potent