FileFix: The New Social Engineering Method

Η Check Point Research reveals the new technique FileFix, a more sophisticated form of the attack ClickFix, which is already being tested in practice by known threat actors.

Cybercriminals continue to exploit human behavior, introducing ever more sophisticated social engineering methods. The latest threat, called FileFix , is already being actively tested in the field by organized cybercriminals, according to Check Point Research , signaling a new era in social engineering attacks.

See more articles from iGuRu.gr when you search for news on Google.

iGuRu.gr preferred source

Τι είναι το FileFix;

FileFix is ​​a new technique that builds on the well-known ClickFix method , but with an even more discreet implementation. While ClickFix invited users to execute malicious commands via the Windows Run window , FileFix moves the attack to the familiar environment of Windows Explorer ( File Explorer ).

Specifically, a malicious website can open a File Explorer window and simultaneously silently copy a disguised PowerShell command to the user's clipboard . The user is prompted to paste what they think is a file path into the Explorer address bar – but in reality, they are pasting and executing malicious code.

How the attack works

1. The user visits a malicious website.
2. The page automatically opens a window File Explore.
3. A malicious command PowerShell copied to the user's clipboard.
4. The user pastes the "assumed" path into Explore and feet Enter.
5. The command is executed and may install malware without warning.

Activity in Action

Just two weeks after security researcher mr . d 0 x publicly disclosed the method , Check Point detected active testing of FileFix by a well-known cybercriminal group. The group had previously used ClickFix in phishing attacks against cryptocurrency platform users.

On July 6, 2025, a new Phishing page that imitates services CAPTCHA, using it FileFix with innocent payload – indicative that they are preparing for full malicious exploitation of the technique.

Threat Factor Profile

This group uses SEO poisoning and malvertising techniques to promote phishing websites that mimic popular services (e.g. 1 Password ), aiming to install software such as NetSupport Manager , RATs and stealers . A particular feature of their attacks is the use of fake Cloudflare -style security verification pages , translated into multiple languages ​​(English, Korean, Russian, etc.).

How to Protect Yourself – Recommendations for Organizations and Users

• Increased vigilance on websites or emails that ask you to paste “paths” or commands into File Explore ή Run.
• User training: None valid website does not require manual execution of commands.
• Tracking clipboard and unusual PowerShell actions through EDR tools.
• Malware detection Phishing pages that imitate well-known services or present false errors CAPTCHA.
• Continuous updates security teams and users about new social engineering techniques.

Protection with Harmony Endpoint Check Point

Harmony Endpoint offers advanced endpoint detection and response capabilities, detecting suspicious behaviors such as clipboard manipulation and PowerShell command execution attempts . With a combination of behavioral analysis, proactive detection , and immediate blocking, organizations can protect against threats such as FileFix and ClickFix.

newsbot

Although the press releases will range from very select to rare, I said I'd pass...because sometimes the editors hide.