What is FileFix — a ClickFix variation? | Kaspersky official blog
Source Kaspersky Security Blog
Description
FileFix — the latest variation of the ClickFix attack using social engineering. How this scheme works, and how to protect your company against FileFix.
Impact
For European organizations, the FileFix attack poses a significant risk primarily through social engineering and stealthy malware delivery. The attack can lead to unauthorized execution of malicious code, potentially resulting in data breaches, system compromise, lateral movement within networks, and deployment of ransomware or other malware. Because the attack bypasses traditional download detection by smuggling malware through browser cache and leveraging legitimate Windows components like PowerShell and conhost.exe, it can evade many standard security controls. Organizations with insufficient endpoint protection or low employee cybersecurity awareness are particularly vulnerable. The impact is exacerbated in sectors with high-value data or critical infrastructure, where compromise can disrupt operations or cause reputational damage. Additionally, the attack’s reliance on user interaction means that phishing defenses and user training effectiveness directly influence risk levels. Given the stealth and complexity, incident response may be delayed, increasing potential damage. Overall, the threat challenges traditional perimeter defenses and highlights the need for layered security and continuous user education in European enterprises.
Defensive guidance
1. Deploy advanced endpoint detection and response (EDR) solutions capable of monitoring and blocking suspicious PowerShell and script execution, especially those launched via conhost.exe or other legitimate Windows processes. 2. Implement application whitelisting and restrict PowerShell execution policies to limit unauthorized script runs. 3. Enhance email security by using advanced phishing detection, sandboxing, and URL filtering to reduce the likelihood of users reaching malicious fake websites. 4. Conduct targeted, regular cybersecurity awareness training focusing on social engineering tactics like FileFix and ClickFix, emphasizing skepticism of unsolicited instructions to execute commands or paste strings into system interfaces. 5. Monitor and analyze browser cache behavior and network traffic for anomalies indicative of cache smuggling or hidden payload delivery. 6. Consider deploying behavioral analytics to detect unusual user actions, such as pasting long command strings into File Explorer or other uncommon workflows. 7. Maintain strict privilege management to minimize the impact of compromised user accounts, ensuring users operate with least privilege necessary. 8. Establish clear incident response procedures to quickly investigate and contain suspected FileFix or similar social engineering attacks. 9. Avoid disabling common user interface shortcuts that may disrupt legitimate workflows; instead, focus on detection and user education. 10. Regularly update and patch all endpoint security tools and Windows OS components to leverage the latest protections against script-based attacks.
Summary
FileFix is a novel social engineering attack technique identified as a variation of the previously known ClickFix method. Both attacks rely on tricking users into executing malicious code on their Windows devices, but FileFix specifically manipulates the Windows File Explorer address bar instead of the Run dialog box. Attackers initiate the attack by sending phishing emails directing victims to counterfeit websites that simulate legitimate online services. These fake sites display error messages and instruct users to perform an "environment check" or "diagnostic" by copying a file path and pasting it into the File Explorer address bar. The critical deception lies in the crafted string: although the visible portion appears to be a harmless file path, it is actually preceded by a long, hidden malicious command containing spaces to push the payload out of view. When the victim pastes and executes this string, it launches a PowerShell script via conhost.exe, which can perform various malicious actions depending on user privileges and security controls. One documented use involves "cache smuggling," where a JPEG file cached by the browser actually contains an archive with malware. The PowerShell script extracts and executes this malware without triggering typical download or network alerts, enhancing stealth. Unlike ClickFix, where blocking the Run dialog key combination ([Win] + [R]) can mitigate risk, FileFix is harder to prevent because interacting with the File Explorer address bar is common user behavior. Keyboard shortcuts like [CTRL] + [L] cannot be reliably blocked, and users can click the address bar manually. Therefore, the recommended defense strategy focuses on deploying advanced endpoint security solutions capable of detecting and blocking malicious script execution and conducting regular, targeted employee training to raise awareness of such social engineering ploys. This approach helps reduce the likelihood of successful exploitation and limits the impact if an attack occurs.