All their galleries are being copied without them even realizing it: The new danger of the internet has spread

Cybersecurity experts have identified a new social engineering attack method that requires little to no user interaction. Dubbed "FileFix," this method targets Windows users and allows them to infiltrate systems via malicious commands copied to the clipboard.

A SEEMINGLY SIMPLE, HARMFUL COMMAND BEHIND

The FileFix method is described as a variant of the previously known ClickFix attack technique. It tricks users into performing a simple step like "Open File Explorer" and then executes malicious commands in the background via PowerShell.

The attack progresses step by step as follows:

-The user is directed to a fake web page.

-Click on a button similar to "Open File Explorer" on the page.

-Simultaneously, a malicious PowerShell command is automatically copied to the clipboard using JavaScript.

-The user is told to “paste it into the address bar and press Enter.”

-With this step, the command runs and the malware is activated.

USER HABITS ARE BEING ABUSED

According to experts, FileFix doesn't exploit a technical vulnerability. Instead, it exploits users' daily habits to infiltrate systems. The attack's effectiveness stems from the fact that it appears to be a natural process on the user's computer.

Check Point researchers stated that this technique has already been used, but that no malware has yet been deployed. The system is currently being used as a "test."

“DEFENSE IS BECOMING MUCH MORE DIFFICULT”

Dray Agha, director of security operations at cybersecurity firm Huntress, said FileFix is widely used and many people fall for it. He noted that attackers can bypass traditional security mechanisms by targeting Windows' core operating systems.

HOW TO PROTECT?

Experts recommend the following precautions for both individual users and IT security teams:

For Corporate Security Teams:

-Keep a close eye on fake verification and phishing sites.

-Implement security rules that follow PowerShell commands and keep them up to date.

-Update training and security protocols against social engineering attacks.

-Employees should not implement unusual requests without confirming them.

For Individual Users:

-Be wary of copy-paste commands from web pages or emails.

-Real applications and services usually do not ask you to run manual commands.

-Be suspicious of any visual verification or file sharing requests from sources you do not know.