FileFix Campaign Hides StealC Malware in Images

Before you can defend against FileFix, everyone on the team needs to understand the one thing it depends on: the victim runs the command themselves.

FileFix is a social-engineering attack that convinces a user to paste a hidden command into the Windows File Explorer address bar, where it executes as if the user typed it - which lets the attack bypass email filters, attachment scanners, and download warnings entirely.

It is the successor to ClickFix, the copy-and-paste trick that surged through 2024 and 2025 as a favorite delivery method for infostealers. ClickFix asks the victim to paste a command into the Windows Run box or a terminal. FileFix, first demonstrated by red-team researcher mr.d0x, moves the same idea into the File Explorer address bar, a place people paste paths every day without thinking twice. The Acronis Threat Research Unit found the first real campaign using it in the wild, impersonating Meta account-suspension notices.

Here is what makes it slippery. There is no malicious file arriving in an inbox for a scanner to quarantine. The payload rides inside an ordinary JPG hosted on a legitimate code-hosting platform, so the download itself looks routine. The malicious logic is buried in the image using steganography, the practice of hiding data inside other data. Standard security tools see a user opening File Explorer and a machine fetching a picture. Nothing about that pattern trips a traditional alarm.

• It weaponizes a trusted action. Pasting a path into File Explorer is something staff do constantly, so the request does not feel dangerous the way "open this .exe" would.
• It hides the payload in plain sight. The JPG looks like an AI-generated stock scene. The encrypted PowerShell script and executables are woven into the image data with steganography.
• It borrows legitimacy. Hosting the image on a mainstream code-sharing service means the download comes from a domain most businesses would never think to block.

The final payload is StealC, an infostealer that harvests saved passwords from browsers, cryptocurrency wallets, data from messaging apps, and cloud-service credentials. For a Houston business, that is the whole account catalog: the email login, the QuickBooks password saved in Chrome, the banking session, the vendor portals. StealC can also pull down additional malware, so one infection is rarely the end of the story.

The attack has a script, and once your team knows the script, the red flags are obvious every time.

Every FileFix lure ends with the same demand: paste this text into a system dialog to fix a problem. No legitimate company - not Meta, not Microsoft, not your bank - will ever ask you to paste a command into File Explorer, the Run box, or a terminal to verify an account.

The campaign Acronis documented opens with urgency. The message claims a Facebook or Meta business account will be suspended, often within seven days, for a policy violation. Urgency plus a brand people trust is the oldest lever in social engineering, and it works because a suspended business page feels like an emergency. The fake support page then walks the victim through "steps" that end at the paste.

Teach your team to stop at these signals:

• Step 1 - Treat any "paste this to continue" instruction as an attack. The instant a web page tells someone to copy text and paste it into File Explorer, the Run dialog, PowerShell, or Terminal, the answer is no. Close the tab and report it. This single rule defeats both ClickFix and FileFix regardless of the brand being impersonated.
• Step 2 - Slow down on account-suspension urgency. A countdown ("suspended in 7 days") exists to short-circuit judgment. Verify account status by typing the real service address into the browser yourself, never by following the link or the on-page steps.
• Step 3 - Watch what actually gets pasted. A real file path is short and readable. A FileFix payload is a long, obfuscated string, sometimes padded with spaces so the malicious PowerShell scrolls out of view. If the "path" looks like code, it is code.

Recognition is a training problem, and training works. When staff have seen the exact script - fake suspension, official-looking page, an instruction to paste something - they catch the next one on sight. In 35 years around this work, the businesses that get burned by copy-paste attacks are almost always the ones that never named the pattern out loud for their people. The ones that ran even a short session on it tend to report the lure instead of following it.

Training reduces the odds someone pastes the command. Endpoint controls make sure that even if they do, nothing happens.

The technical control that breaks FileFix is blocking web browsers from spawning script interpreters - PowerShell, CMD, MSHTA, and MSIEXEC - because the entire attack depends on the browser handing a pasted command off to PowerShell to run.

Recognition is your first layer, but people are human and someone eventually clicks. That is why defense in depth matters: layer controls so the failure of any one does not mean compromise. Acronis' analysis of the campaign points to a set of endpoint measures that a managed IT partner can deploy across every machine at once.

• Step 4 - Block browser-spawned shells and deploy real endpoint detection. Configure endpoints so browsers cannot launch PowerShell, CMD, MSHTA, or MSIEXEC as child processes. Pair that with an endpoint detection and response tool that watches for PowerShell pulling down image files and for scripts writing and executing hidden payloads. Add application allowlisting so unapproved executables never run, and network monitoring that flags PowerShell reaching out to code-hosting platforms - traffic that is normal for a developer and deeply abnormal for the front desk.

Notice that each of these controls targets a different link in the chain from the infographic above. The browser-child-process block stops step 2 from ever reaching step 3. Endpoint detection and response catches the steganography extraction at step 4. Network monitoring flags the JPG pull at step 3 when it comes from an unexpected machine. You do not need all of them to fire - you need enough overlap that the attack trips at least one wire.

This is also where the difference between antivirus and modern endpoint detection shows up. Signature-based antivirus looks for known-bad files, and FileFix deliberately avoids dropping one until the last moment, working in memory for as long as it can. Behavior-based detection watches what processes do rather than what they are named, which is the only reliable way to catch an attack that lives inside trusted tools.

Step 5 assumes the worst case - the command ran and StealC harvested credentials - and limits how far the theft can spread.

StealC's whole purpose is stealing credentials, so the containment that matters is making stolen credentials useless: multi-factor authentication on every account, fast password rotation, and session controls that log an attacker out even if they have the password.

An infostealer does not detonate like ransomware. It quietly copies your saved logins and session tokens and sends them to the attacker, who then either uses them or sells them. The window between infection and abuse can be short, so the response is built in advance, not improvised after.

• Step 5 - Assume credentials are compromised and shut the door. Turn on multi-factor authentication everywhere so a stolen password alone is not enough to log in. When a machine is suspected of infection, isolate it, rotate the passwords and sessions for every account used on it, and revoke active tokens. Keep an incident response plan that names who does what, so containment starts in minutes rather than after a meeting.

Multi-factor authentication is the highest-value control here because StealC steals what you know (the password) but has a harder time with what you have (a phone or hardware key). It is not perfect - some infostealers grab session tokens to sidestep it - which is why session revocation and short session lifetimes belong in the same plan. Stolen tokens expire; forced re-authentication invalidates them.

The Katy and greater Houston businesses that recover fastest from any credential theft are the ones that already had MFA turned on and a rehearsed response before the incident. The ones still deciding whether MFA is worth the friction are the ones writing breach-notification letters later. That is the whole argument for building this layer before you need it.

CinchOps is a managed IT services provider based in Katy, Texas, serving small and mid-sized businesses across the Houston metro area, turning FileFix and StealC malware defense from a headline you worry about into layered controls that run quietly in the background.

CinchOps specializes in cybersecurity, network security, managed IT support, VoIP, and SD-WAN for businesses with 10-200 employees. Stopping an attack that relies on a trusted action and trusted tools takes the same layered posture we build for every client:

• Endpoint detection and response. Behavior-based monitoring that catches PowerShell pulling images and scripts writing hidden payloads, not just known-bad files.
• Browser and application hardening. Blocking browsers from spawning PowerShell, CMD, MSHTA, and MSIEXEC, plus application allowlisting so unapproved code never runs.
• Security awareness training. Sessions built around the copy-paste lures actually hitting Houston businesses, so staff report the trick instead of following it.
• Identity and access protection. Multi-factor authentication, session controls, and rapid credential rotation that make stolen logins useless.

You do not need a full-time security team to shut down FileFix - you need training your staff remember and controls that assume a human will slip. If your business in Houston or Katy runs on social media accounts and saved browser passwords, the exposure is real, and it is fixable. Talk to CinchOps and we will put the layers in place before someone pastes the command.