Cybersecurity researchers have identified a dangerous new campaign that exploits a variant of the FileFix social engineering technique to distribute StealC information-stealing malware. This sophisticated attack demonstrates how cybercriminals are evolving their tactics to bypass modern security measures.
## How the Attack Works
The campaign begins with highly convincing multilingual phishing websites that mimic legitimate platforms like Facebook Security pages. These sites employ advanced obfuscation techniques and anti-analysis measures to avoid detection by security tools.
The attack follows a carefully orchestrated sequence:
1. **Initial Contact**: Victims receive phishing emails warning of potential Facebook account suspension due to alleged policy violations
2. **Deceptive Redirect**: Users are directed to fake security pages and prompted to appeal the decision
3. **FileFix Exploitation**: The malicious site leverages the browser’s file upload feature to trick users into executing harmful commands
4. **Payload Delivery**: Malicious components are downloaded from legitimate platforms like Bitbucket, exploiting trust in these services
## FileFix vs. ClickFix: A New Evolution
FileFix represents a significant advancement over the previously known ClickFix technique. While ClickFix required users to open Windows Run dialog and paste obfuscated commands, FileFix simplifies the process by using the browser’s native file upload functionality.
The key innovation lies in its deception: when users click “Copy” to access what appears to be a harmless PDF path, they actually copy a malicious PowerShell command. This command downloads disguised images containing malware components, decodes them, and executes a Go-based loader that ultimately deploys the StealC information stealer.
## Technical Advantages and Risks
FileFix offers attackers several advantages over traditional methods:
– **Harder to Block**: It exploits standard browser features rather than system dialogs that administrators might restrict
– **Increased Stealth**: The technique appears more legitimate to unsuspecting users
– **Platform Abuse**: Uses trusted repositories like Bitbucket to host malicious content
However, security experts note that FileFix payloads executed through web browsers may be more detectable during investigations compared to ClickFix attacks that spawn from system processes.
## Related Threats
Security researchers have also identified similar campaigns using fake support portals and Cloudflare CAPTCHA pages to distribute AutoHotkey (AHK) scripts. These scripts profile compromised systems and deliver additional malware, including remote access tools like AnyDesk and TeamViewer, along with various information stealers.
## Protection Recommendations
Organizations and individuals should remain vigilant against these evolving social engineering tactics. The sophistication of these campaigns, including their multilingual capabilities and advanced evasion techniques, demonstrates the significant resources cybercriminals are investing in their operations.
This development highlights the ongoing cat-and-mouse game between cybersecurity professionals and threat actors, emphasizing the need for continuous awareness and updated security measures.