FileFix: A New Attack Hides Malware in Plain Sight

September 18, 2025 reports from Acronis’ Threat Research Unit (TRU) detail a rare in-the-wild FileFix campaign, the first observed outside proof-of-concept demonstrations and building on the recent ClickFix wave. The campaign uses steganography to embed a second-stage PowerShell script and encrypted payloads within seemingly harmless JPG images, with victims tricked into pasting a file path that causes the payload to download an image from a trusted platform and extract the malicious code.

TRU notes the phishing infrastructure was highly convincing, multilingual across 16 languages, and backed by minified, obfuscated JavaScript to evade analysis. The infection chain is multi-stage: a first-stage PowerShell script, a second-stage script extracted from the JPEG using RC4 decryption and gzip, and a final Go-based loader that performs sandbox checks and decrypts strings to execute a StealC infostealer. StealC can harvest browser credentials, cryptocurrency wallets, messaging data and cloud keys, while also serving as a loader for additional malware.