FileFix in the wild! New FileFix campaign goes beyond POC and leverages steganography

[Khushal]

Content source

https://www.acronis.com/en/tru/posts/filefix-in-the-wild-new-filefix-campaign-goes-beyond-poc-and-leverages-steganography/

FileFix in the wild! New FileFix campaign goes beyond POC and leverages steganography

Acronis' Threat Research Unit discovered a rare in-the-wild example of a FileFix attack — a new variant of the now infamous ClickFix attack vector.

www.acronis.com

 

[Andy Ful]

This method fails when PowerShell is set to Constrained Language Mode or prevented from making outbound connections. Both methods will block PowerShell from downloading the JPG payload. For example the below crucial CmdLines are forbidden in Constrained Language:
[System.Text.Encoding]::UTF8.GetString.Invoke('')
[System.Convert]::FromBase64String.Invoke('')

They are used used in this ClickFix attack to decode the first stage Base64 encoded payload.

 

[Khushal]

This method fails when PowerShell is set to Constrained Language Mode or prevented from making outbound connections. Both methods will block PowerShell from downloading the JPG payload. For example the below crucial CmdLines are forbidden in Constrained Language:
[System.Text.Encoding]::UTF8.GetString.Invoke('')
[System.Convert]::FromBase64String.Invoke('')

View attachment 290975

They are used used in this ClickFix attack to decode the first stage Base64 encoded payload.

Thanks for the insight mate however i am concerned rn about shulud.

 

[Andy Ful]

Thanks for the insight mate however i am concerned rn about shulud.
View attachment 290976

What is the source of this JavaScript? It is not included in the article.
Is it a script embedded in the website?

 

[Khushal]

Thread '“It’s Happening Again”: Tinycolor’s Worm Jumps Hosts, CrowdStrike Packages Trojanized'

Sep 16, 2025

Ongoing Supply Chain Attack Targets CrowdStrike npm Packages...

Socket.dev found compromised various CrowdStrike npm packages, continuing the "Shai-Halud" supply-chain attack that previously hit `tinycolor`.

socket.dev

Popular Tinycolor npm Package Compromised in Supply Chain At...

Malicious update to @ctrl/tinycolor on npm is part of a supply-chain attack hitting 40+ packages across maintainers

socket.dev

• Khushal
• Replies: 2
• Forum: News Archive

• 

 

[Andy Ful]

Thread '“It’s Happening Again”: Tinycolor’s Worm Jumps Hosts, CrowdStrike Packages Trojanized'

Sep 16, 2025

Ongoing Supply Chain Attack Targets CrowdStrike npm Packages...

Socket.dev found compromised various CrowdStrike npm packages, continuing the "Shai-Halud" supply-chain attack that previously hit `tinycolor`.

socket.dev

Popular Tinycolor npm Package Compromised in Supply Chain At...

Malicious update to @ctrl/tinycolor on npm is part of a supply-chain attack hitting 40+ packages across maintainers

socket.dev

• Khushal
• Replies: 2
• Forum: News Archive

• 

This is a supply-chain attack unrelated to the ClickFix from the OP. It would require another thread.