FileFix attacks use fake Facebook security alerts to trick victims into running infostealers

An attack called FileFix is masquerading as a Facebook security alert before ultimately dropping the widely used StealC infostealer and malware downloader on Windows machines. FileFix is a variation on ClickFix, a newish type of social-engineering technique first spotted last year that tricks victims into running malware on their own devices using fake fixes and login prompts. These types of attacks have surged by 517 percent in the past six months, according to researchers at antivirus and internet security software vendor ESET, making them second most common attack vector behind phishing. ClickFix typically asks the victim to perform a fake CAPTCHA test. FileFix tricks the user into copying and pasting a command into a file upload window or File Explorer, which after victims press Enter executes the payload(s) on their own machine. This beautiful house. These doors. It's an evasion technique. It's also a mark of a sophisticated attacker Acronis' Threat Research Unit discovered the FileFix attack in late August, and told The Register that it's the first in-the-wild example that doesn't strictly follow the original proof-of-concept (PoC) attack demonstrated by a researcher known as “mr.d0x” in July. "I've seen samples pop up on the 13th, which is a couple of days ago," Acronis senior researcher Eliad Kimhy told The Register, noting a burst of VirusTotal file submissions and phishing sites associated with this attack. "They keep evolving the infrastructure." The VirusTotal upl...