Click, Paste, Compromise: Inside the New FileFix Campaign
Summary
A global FileFix campaign has been uncovered, demonstrating the rapid evolution of ClickFix-style attacks into highly polished, real-world threats. This campaign lures Facebook users with fake account appeal pages, tricking them into pasting malicious commands into file dialogs.
What appears to be a simple PDF path instead triggers a multi-stage PowerShell chain that uses obfuscation, steganography, and Bitbucket hosting to deliver the StealC infostealer. StealC exfiltrates passwords, crypto wallets, chat data, and cloud keys. This attack highlights how “*Fix” techniques are maturing from proof-of-concept demonstrations into scalable, effective social engineering campaigns.
Attack Details
The campaign represents a significant leap in adversary tradecraft, featuring:
- Sophisticated Phishing Infrastructure: Convincing portals designed to look like Facebook’s security pages, warning of account suspension.
- FileFix Abuse: Victims paste malicious paths into file upload dialogs, unknowingly triggering a hidden payload.
- Multi-Stage PowerShell Chain:
- Downloads AI-generated JPG images containing hidden data.
- Decodes and decrypts embedded scripts using RC4 and gzip routines.
- Executes additional shellcode to deploy the final payload.
- Heavy Obfuscation: Minified and fragmented phishing JavaScript, randomized identifiers, multilingual support for broader targeting.
- Payload Delivery: The final stage uses a Go-based loader to deliver StealC malware, which harvests credentials, browser data, cloud access keys, and cryptocurrency wallet information.
Recommendations
- Train Users on Copy-Paste Traps: Educate employees that no legitimate service will ask them to paste commands into File Explorer, Run dialog, or terminals.
- Restrict PowerShell Usage: Implement script-blocking and application control to prevent hidden PowerShell chains from executing.
- Behavioral Monitoring: Detect unusual activity such as immediate execution of downloaded images or large encoded PowerShell strings.
- Enhance Endpoint Security: Use NGAV and EDR solutions with behavioral and ML-based detection to block StealC and similar infostealers.
Indicators of Compromise (IoCs)
SHA256 Hashes
- 70AE293EB1C023D40A8A48D6109A1BF792E1877A72433BCC89613461CFFC7B61
- 06471E1F500612F44C828E5D3453E7846F70C2D83B24C08AC9193E791F1A8130
- 08FD6813F58DA707282915139DB973B2DBE79C11DF22AD25C99EC5C8406B234A
- 2654D6F8D6C93C7AF7B7B31A89EBF58348A349AA943332EBB39CE552DDE81FC8
- FD30A2C90384BDB266971A81F97D80A2C42B4CEC5762854224E1BC5C006D007A
- 1D9543F7C0039F6F44C714FE8D8FD0A3F6D52FCAE2A70B4BC442F38E01E14072
- 1801DA172FAE83CEE2CC7C02F63E52D71F892D78E547A13718F146D5365F047C
- 7022F91F0534D980A4D77DF20BEA1AE53EE02F7C490EFBFAE605961F5170A580
- B3CE10CC997CD60A48A01677A152E21D4AA36AB5B2FD3718C04EDEF62662CEA1
IPv4 Address
- 77[.]90[.]153[.]225
Domains
- facebook[.]meta-software-worldwide[.]com
- facebook[.]windows-software-downloads[.]com
- facebook[.]windows-software-updates[.]cc
- facebook[.]windows-software-updates[.]com
- elprogresofood[.]com
- mastercompu[.]com
- thanjainatural[.]com
- Bitbucket[.]org/pibejiloiza/
- Bitbucket[.]org/brubroddagrofe/
- Bitbucket[.]org/creyaucuronna-4413/
- Grabify[.]link/5M6TOW
MITRE ATT&CK TTPs
- Initial Access: T1566 (Phishing), T1566.002 (Spearphishing Link)
- Execution: T1204 (User Execution), T1204.004 (Malicious Copy and Paste), T1059 (Command and Scripting Interpreter), T1059.001 (PowerShell)
- Defense Evasion: T1027 (Obfuscated Files or Information), T1027.003 (Steganography), T1497 (Virtualization/Sandbox Evasion)
- Discovery: T1217 (Browser Information Discovery)
- Exfiltration: T1132 (Data Encoding)
- Command & Control: T1071 (Application Layer Protocol)
.svg)