Incident : Malware

FAC4793447091625

Exposure Impact

Title: FileFix Attack Dropping StealC Infostealer via Fake Facebook Security Alerts

Description: An attack called FileFix masquerades as a Facebook security alert, tricking victims into executing malicious commands that ultimately drop the StealC infostealer and malware downloader. The attack is a variation of ClickFix, a social-engineering technique that surged by 517% in the past six months. Victims are deceived into copying and pasting a command into a file upload window or File Explorer, which executes the payload. The attack uses AI-generated images (e.g., a bucolic house, intricate doors) embedded with PowerShell scripts and encrypted executables to evade detection. The final payload includes a Go-written loader that checks for VM environments before deploying StealC v2, which targets browsers, cryptocurrency wallets, messaging apps, VPNs, and cloud service credentials (Azure, AWS). The campaign has global reach, with submissions from multiple countries, and leverages BitBucket for hosting malicious images to avoid domain-based detection.

Date Detected: 2024-08-late

Date Publicly Disclosed: 2024-08-late

Type: Malware

Attack Vector: Fake Facebook Security AlertUser-Executed Command via File ExplorerAI-Generated Image PayloadsPowerShell Script Embedding

Vulnerability Exploited: Human Trust (Social Engineering)

Motivation: Data TheftCredential HarvestingFinancial Gain (Potential Ransomware/Fraud)

Incident : Malware FAC4793447091625

Entity Name: Facebook (Brand Abused)

Entity Type: Social Media Platform

Industry: Technology

Location: Global

Customers Affected: Users Worldwide (US, Bangladesh, Philippines, Tunisia, Nepal, Dominican Republic, Serbia, Peru, China, Germany, etc.)

Incident : Malware FAC4793447091625

Entity Name: Individual Victims

Entity Type: End Users

Location: Global (Multi-Country)

Incident : Malware FAC4793447091625

Third Party Assistance: Acronis Threat Research Unit.

Communication Strategy: Public Disclosure via The RegisterResearch Report by Acronis

Incident : Malware FAC4793447091625

Type of Data Compromised: Credentials, Session cookies, Cryptocurrency wallet data, Messaging app data, Vpn configurations, Cloud service keys, Pii (potential)

Sensitivity of Data: High

Data Exfiltration: Likely (StealC Capabilities)

Data Encryption: Partial (Payload Encrypted in Images)

File Types Exposed: JPG (Malicious Images)PowerShell ScriptsExecutables

Personally Identifiable Information: Potential (Browser Autofill, Saved Logins)

Incident : Malware FAC4793447091625

Lessons Learned: Evolution of social engineering tactics beyond traditional phishing (e.g., user-executed commands via fake file prompts)., Effectiveness of AI-generated imagery in evading detection and luring victims., Rapid weaponization of proof-of-concept (PoC) attacks (75 days from PoC to global campaign)., Need for updated anti-phishing training to address 'Fix'-type attacks (ClickFix/FileFix)., Shift from malicious domains to legitimate platforms (e.g., BitBucket) for payload hosting.

Incident : Malware FAC4793447091625

Recommendations: Educate users on 'Fix'-style attacks (e.g., fake CAPTCHAs, file upload prompts)., Monitor for unusual PowerShell activity originating from image files., Block execution of scripts from temporary directories (e.g., %Temp%)., Implement behavioral detection for malware using image steganography., Enhance email/phishing filters to detect fake social media alerts., Restrict access to file-sharing platforms (e.g., BitBucket) for untrusted sources., Deploy endpoint detection for StealC indicators (e.g., targeted app data exfiltration).Educate users on 'Fix'-style attacks (e.g., fake CAPTCHAs, file upload prompts)., Monitor for unusual PowerShell activity originating from image files., Block execution of scripts from temporary directories (e.g., %Temp%)., Implement behavioral detection for malware using image steganography., Enhance email/phishing filters to detect fake social media alerts., Restrict access to file-sharing platforms (e.g., BitBucket) for untrusted sources., Deploy endpoint detection for StealC indicators (e.g., targeted app data exfiltration).Educate users on 'Fix'-style attacks (e.g., fake CAPTCHAs, file upload prompts)., Monitor for unusual PowerShell activity originating from image files., Block execution of scripts from temporary directories (e.g., %Temp%)., Implement behavioral detection for malware using image steganography., Enhance email/phishing filters to detect fake social media alerts., Restrict access to file-sharing platforms (e.g., BitBucket) for untrusted sources., Deploy endpoint detection for StealC indicators (e.g., targeted app data exfiltration).Educate users on 'Fix'-style attacks (e.g., fake CAPTCHAs, file upload prompts)., Monitor for unusual PowerShell activity originating from image files., Block execution of scripts from temporary directories (e.g., %Temp%)., Implement behavioral detection for malware using image steganography., Enhance email/phishing filters to detect fake social media alerts., Restrict access to file-sharing platforms (e.g., BitBucket) for untrusted sources., Deploy endpoint detection for StealC indicators (e.g., targeted app data exfiltration).Educate users on 'Fix'-style attacks (e.g., fake CAPTCHAs, file upload prompts)., Monitor for unusual PowerShell activity originating from image files., Block execution of scripts from temporary directories (e.g., %Temp%)., Implement behavioral detection for malware using image steganography., Enhance email/phishing filters to detect fake social media alerts., Restrict access to file-sharing platforms (e.g., BitBucket) for untrusted sources., Deploy endpoint detection for StealC indicators (e.g., targeted app data exfiltration).Educate users on 'Fix'-style attacks (e.g., fake CAPTCHAs, file upload prompts)., Monitor for unusual PowerShell activity originating from image files., Block execution of scripts from temporary directories (e.g., %Temp%)., Implement behavioral detection for malware using image steganography., Enhance email/phishing filters to detect fake social media alerts., Restrict access to file-sharing platforms (e.g., BitBucket) for untrusted sources., Deploy endpoint detection for StealC indicators (e.g., targeted app data exfiltration).Educate users on 'Fix'-style attacks (e.g., fake CAPTCHAs, file upload prompts)., Monitor for unusual PowerShell activity originating from image files., Block execution of scripts from temporary directories (e.g., %Temp%)., Implement behavioral detection for malware using image steganography., Enhance email/phishing filters to detect fake social media alerts., Restrict access to file-sharing platforms (e.g., BitBucket) for untrusted sources., Deploy endpoint detection for StealC indicators (e.g., targeted app data exfiltration).

Incident : Malware FAC4793447091625

Source: The Register

Incident : Malware FAC4793447091625

Source: Acronis Threat Research Report

Incident : Malware FAC4793447091625

Source: ESET Research (ClickFix/FileFix Surge Data)

Incident : Malware FAC4793447091625

Source: VirusTotal Submissions

URL: https://www.virustotal.com

Incident : Malware FAC4793447091625

Investigation Status: Ongoing (Active Campaign)

Incident : Malware FAC4793447091625

Customer Advisories: Acronis Blog/Report (Expected)Potential Facebook Security Notices

Incident : Malware FAC4793447091625

Entry Point: Fake Facebook Security Alert Pdf, User-Executed Command In File Explorer,

Backdoors Established: Potential (StealC's Secondary Payload Capabilities)

High Value Targets: Cryptocurrency Wallets, Cloud Service Credentials, Enterprise Vpn Access,

Data Sold on Dark Web: Cryptocurrency Wallets, Cloud Service Credentials, Enterprise Vpn Access,

Incident : Malware FAC4793447091625

Root Causes: Lack Of User Awareness About 'Fix'-Type Social Engineering., Over-Reliance On Domain Reputation For Detection (Attackers Used Bitbucket)., Effective Evasion Via Image Steganography And Ai-Generated Lures., Rapid Iteration Of Attack Infrastructure (New Variants Deployed Frequently).,