SecuriTricks - filefix

Tracking FileFix, Shadow Vector, and SideWinder

This intelligence report details collaborative research between Acronis Threat Research Unit and VirusTotal on three emerging cyber threats. FileFix, a variant of ClickFix, uses malicious websites to trick victims into running commands copied to their clipboard. Shadow Vector targets Colombian user…

yara

CVE-2017-0199

clipboard manipulation

shadow vector

document-based attacks

Published: November 10, 2025

Linked vulnerabilities : CVE-2017-11882, CVE-2017-0199

Downloadable IOCs: 16

FileFix in the wild! New FileFix campaign goes beyond POC and leverages steganography

A sophisticated FileFix attack campaign has been discovered, marking the first use of this technique beyond proof-of-concept. The attack employs a complex phishing infrastructure, including a multilingual site mimicking Facebook security. It uses steganography to conceal malicious code in images, w…

Published: September 16, 2025

Downloadable IOCs: 17

From a Fake AnyDesk Installer to MetaStealer

A recent attack mimicking ClickFix tactics used a fake AnyDesk installer to deploy MetaStealer. The infection chain involved a fake Cloudflare Turnstile lure, Windows search protocol, and an MSI package disguised as a PDF. Unlike traditional ClickFix attacks, this variant redirected users to Window…

windows file explorer

Published: August 30, 2025

Downloadable IOCs: 0

KongTuke FileFix Leads to New Interlock RAT Variant

A new and resilient variant of the Interlock ransomware group's remote access trojan (RAT) has been identified. This PHP-based malware, a shift from the previous JavaScript-based NodeSnake, is being used in a widespread campaign associated with the LandUpdate808 (KongTuke) web-inject threat cluster…

Published: July 15, 2025

Downloadable IOCs: 12

Tag: filefix

Attack reports

Tracking FileFix, Shadow Vector, and SideWinder

FileFix in the wild! New FileFix campaign goes beyond POC and leverages steganography

From a Fake AnyDesk Installer to MetaStealer

KongTuke FileFix Leads to New Interlock RAT Variant