{"id":59357,"date":"2025-09-16T12:02:26","date_gmt":"2025-09-16T12:02:26","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/filefix-attacks-use-fake-facebook-security-alerts-to-trick-victims-into-running-infostealers\/"},"modified":"2025-09-16T12:02:26","modified_gmt":"2025-09-16T12:02:26","slug":"filefix-attacks-use-fake-facebook-security-alerts-to-trick-victims-into-running-infostealers","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/filefix-attacks-use-fake-facebook-security-alerts-to-trick-victims-into-running-infostealers\/","title":{"rendered":"‘FileFix’ attacks use fake Facebook security alerts to trick victims into running infostealers"},"content":{"rendered":"

An attack called FileFix is masquerading as a Facebook security alert before ultimately dropping the widely used StealC infostealer and malware downloader.<\/p>\n

FileFix is a variation on ClickFix<\/a>, a newish type of social-engineering technique first spotted last year<\/a> that tricks victims into running malware on their own devices using fake fixes and login prompts. These types of attacks have surged by 517 percent<\/a> in the past six months, according to researchers at antivirus and internet security software vendor ESET, making them second most common attack vector behind phishing.<\/p>\n

ClickFix typically asks the victim to perform a fake CAPTCHA test<\/a>. FileFix tricks the user into copying and pasting a command into a Windows Run Dialog or File Explorer, which after victims press Enter executes the payload(s) on their own machine.<\/p>\n

\n

This beautiful house. These doors. It’s an evasion technique. It’s also a mark of a sophisticated attacker<\/p>\n<\/blockquote>\n

Acronis’ Threat Research Unit discovered the FileFix attack<\/a> in late August, and told The Register<\/em> that it’s the first in-the-wild example that doesn’t strictly follow the original proof-of-concept (PoC) attack<\/a> demonstrated by a researcher known as \u201cmr.d0x\u201d in July.<\/p>\n

“I’ve seen samples pop up on the 13th, which is a couple of days ago,” Acronis senior researcher Eliad Kimhy told The Register<\/em>, noting a burst of VirusTotal file submissions and phishing sites associated with this attack. “They keep evolving the infrastructure.”<\/p>\n