FileFix in the wild! New FileFix campaign goes beyond POC and leverages steganography

A sophisticated FileFix attack campaign has been discovered, marking the first use of this technique beyond proof-of-concept. The attack employs a complex phishing infrastructure, including a multilingual site mimicking Facebook security. It uses steganography to conceal malicious code in images, with a multistage payload delivery system featuring layered obfuscation and evasion techniques. The final payload deploys a StealC infostealer targeting various applications and credentials. The campaign has evolved rapidly over two weeks, indicating a global targeting strategy with potential victims in multiple countries. This attack represents a significant advancement in *Fix attack sophistication, combining FileFix with advanced tradecraft to maximize both evasion and impact.

• Case of AgentTesla Malware Distribution Disguised as a Business Proposal EmailMalware2026-10-14
• Fake Calendly "Meta Careers" pages steal Facebook and Google loginsCampaign2026-10-14
• Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial AccessMalware2026-10-26
• Infostealer riding the AI TrainMalware2026-10-23
• Microsoft Teams to get AI-powered, context-aware phishing detectionNews2026-10-23