From ClickFix To FileFix: A New Frontier In Social Engineering Attacks

Why ClickFix Worked

• Relied heavily on user trust and interface familiarity.
• Did not require file downloads, bypassing many endpoint defenses.
• Exploited human tendency to follow technical-looking prompts without verifying them.

Building on the success of ClickFix, FileFix takes this manipulation to the next level. Discovered by mr.d0x, FileFix replaces the Run dialog with something even more benign-looking: the Windows File Explorer address bar.

Here’s the twist:

Instead of telling users to open a Run box, the attacker simulates a file upload or download process and tricks the user into opening Windows Explorer and pasting a malicious command into the address bar, which can also execute code.

The Core of Both Attacks

At the heart of ClickFix and FileFix lies user psychology. These attacks don’t rely on technical exploits; they rely on convincing the user to carry out the attack for the adversary. If user awareness is high and skeptical, these attacks fail. But when awareness is low, attackers succeed by presenting fake UI elements that blend seamlessly with legitimate workflows.

• Explorer familiarity: Users are used to pasting paths into File Explorer to navigate files. This seems far less suspicious than the Run dialog.
• No MOTW: Since there’s no file download, there’s no Mark-of-the-Web, meaning Windows Defender and SmartScreen don’t flag it as suspicious.
• Bypasses sandboxing: The attack happens entirely within trusted OS interfaces.
• Harder to trace: From a forensic standpoint, it’s difficult to differentiate between a legitimate user action and a malicious paste.

1. User Training
   • Teach employees to never paste unknown content from the clipboard into system dialogs or Explorer address bars.
2. Endpoint Detection Rules (EDR/XDR)
   • Monitor for:
     • PowerShell execution triggered by Explorer.exe or browsers like Chrome/Edge.
     • Suspicious clipboard activity from websites.
   • Disable Command Execution in Explorer (where possible)
   • Consider disabling or restricting script execution from Explorer if your organization allows it.
3. Clipboard Permissions
   • Limit or warn users when a website tries to write to the clipboard using navigator.clipboard.writeText.
4. Application Control Policies
   • Use tools like Microsoft Defender Application Control (MDAC) to block unauthorized script execution.

At Wizard Cyber, we offer proactive protection and incident response to mitigate threats like these:

Our Services Include:

• Managed Microsoft Sentinel
• MXDR for Microsoft
• Microsoft Security Consultancy

Our global SOC team works around the clock to monitor for dark web activity, detect breaches early, and help you harden your identity and access security.