New FileFix Variant Delivers StealC Malware Through Multilingual Phishing Site

A new FileFix variant is being used to deliver the StealC information stealer via a highly convincing multilingual phishing site, cybersecurity researchers have warned. According to Acronis, the campaign uses anti-analysis techniques and advanced obfuscation to evade detection, with the attack chain starting from a phishing page that redirects victims from an email warning of potential suspension of their Facebook accounts.

The site guides users to copy and paste a path into File Explorer, where a malicious command is silently copied to the clipboard and runs a multi-stage PowerShell script that downloads an image from a Bitbucket repository, decodes it, and launches a Go-based loader that unpacks shellcode to run StealC. At a high level, FileFix is marketed as exploiting a browser’s file upload feature rather than a Run dialog, which aids stealth and makes the payload more visible to security tooling.

FileFix was first documented by security researcher mrd0x in June 2025 as a PoC, and this campaign is described as a more advanced real-world deployment. The disclosure also notes Doppel’s separate campaign using fake portals and clipboard hijacking to deliver PowerShell and AutoHotkey-based drops, underscoring the evolving tradecraft behind these social engineering techniques.