Click, Paste, Compromise: Inside the New FileFix Campaign

Click, Paste, Compromise: Inside the New FileFix Campaign

Summary

A global FileFix campaign has been uncovered, demonstrating the rapid evolution of ClickFix-style attacks into highly polished, real-world threats. This campaign lures Facebook users with fake account appeal pages, tricking them into pasting malicious commands into file dialogs.

What appears to be a simple PDF path instead triggers a multi-stage PowerShell chain that uses obfuscation, steganography, and Bitbucket hosting to deliver the StealC infostealer. StealC exfiltrates passwords, crypto wallets, chat data, and cloud keys. This attack highlights how “*Fix” techniques are maturing from proof-of-concept demonstrations into scalable, effective social engineering campaigns.

Attack Details

The campaign represents a significant leap in adversary tradecraft, featuring:

• Sophisticated Phishing Infrastructure: Convincing portals designed to look like Facebook’s security pages, warning of account suspension.

• FileFix Abuse: Victims paste malicious paths into file upload dialogs, unknowingly triggering a hidden payload.

• Multi-Stage PowerShell Chain:

  • Downloads AI-generated JPG images containing hidden data.

  • Decodes and decrypts embedded scripts using RC4 and gzip routines.

  • Executes additional shellcode to deploy the final payload.

• Heavy Obfuscation: Minified and fragmented phishing JavaScript, randomized identifiers, multilingual support for broader targeting.

• Payload Delivery: The final stage uses a Go-based loader to deliver StealC malware, which harvests credentials, browser data, cloud access keys, and cryptocurrency wallet information.

Recommendations

• Train Users on Copy-Paste Traps: Educate employees that no legitimate service will ask them to paste commands into File Explorer, Run dialog, or terminals.

• Restrict PowerShell Usage: Implement script-blocking and application control to prevent hidden PowerShell chains from executing.

• Behavioral Monitoring: Detect unusual activity such as immediate execution of downloaded images or large encoded PowerShell strings.

• Enhance Endpoint Security: Use NGAV and EDR solutions with behavioral and ML-based detection to block StealC and similar infostealers.

Indicators of Compromise (IoCs)

SHA256 Hashes

• 70AE293EB1C023D40A8A48D6109A1BF792E1877A72433BCC89613461CFFC7B61

• 06471E1F500612F44C828E5D3453E7846F70C2D83B24C08AC9193E791F1A8130

• 08FD6813F58DA707282915139DB973B2DBE79C11DF22AD25C99EC5C8406B234A

• 2654D6F8D6C93C7AF7B7B31A89EBF58348A349AA943332EBB39CE552DDE81FC8

• FD30A2C90384BDB266971A81F97D80A2C42B4CEC5762854224E1BC5C006D007A

• 1D9543F7C0039F6F44C714FE8D8FD0A3F6D52FCAE2A70B4BC442F38E01E14072

• 1801DA172FAE83CEE2CC7C02F63E52D71F892D78E547A13718F146D5365F047C

• 7022F91F0534D980A4D77DF20BEA1AE53EE02F7C490EFBFAE605961F5170A580

• B3CE10CC997CD60A48A01677A152E21D4AA36AB5B2FD3718C04EDEF62662CEA1

IPv4 Address

• 77[.]90[.]153[.]225

Domains

• facebook[.]meta-software-worldwide[.]com

• facebook[.]windows-software-downloads[.]com

• facebook[.]windows-software-updates[.]cc

• facebook[.]windows-software-updates[.]com

• elprogresofood[.]com

• mastercompu[.]com

• thanjainatural[.]com

• Bitbucket[.]org/pibejiloiza/

• Bitbucket[.]org/brubroddagrofe/

• Bitbucket[.]org/creyaucuronna-4413/

• Grabify[.]link/5M6TOW

MITRE ATT&CK TTPs

• Initial Access: T1566 (Phishing), T1566.002 (Spearphishing Link)

• Execution: T1204 (User Execution), T1204.004 (Malicious Copy and Paste), T1059 (Command and Scripting Interpreter), T1059.001 (PowerShell)

• Defense Evasion: T1027 (Obfuscated Files or Information), T1027.003 (Steganography), T1497 (Virtualization/Sandbox Evasion)

• Discovery: T1217 (Browser Information Discovery)

• Exfiltration: T1132 (Data Encoding)

• Command & Control: T1071 (Application Layer Protocol)

References

• Acronis – FileFix Campaign Analysis

• MITRE ATT&CK – Techniques Used