New FileFix Steganography Campaign Spreads StealC Malware

A new FileFix Steganography campaign is incrementally maturing, representing the first documented real‑world deployment of FileFix attacks beyond proof‑of‑concept demonstrations, according to Acronis’ Threat Research Unit. The attack delivers StealC, a Go‑based information stealer, via a multi‑stage chain that begins with a heavily obfuscated PowerShell payload and culminates in a loader that decrypts and executes additional payloads hidden inside JPG images.

Victims are lured by a Facebook security‑style phishing site, with social engineering that prompts users to paste malicious commands into a File Explorer window and with multilingual site support spanning 16 languages. The campaign additionally features extensive obfuscation, URL encryption with XOR, and a shift from attacker‑controlled domains to BitBucket hosting, with second‑stage scripts that download AI‑generated landscape images to the victim’s temp directory and deploy their payloads before self‑deleting.

VirusTotal submissions indicate a global campaign, with related files and phishing sites reported from the United States, Bangladesh, Philippines, Tunisia, Nepal, Dominican Republic, Serbia, Peru, China, Germany, and other locations.