Cybersecurity researchers at Check Point have identified a new, insidious social engineering technique that requires almost no user interaction.
The FileFix technique builds on an already widely used tactic called ClickFix, which according to Check Point tricks users into running malicious commands in the Windows Run dialog.
FileFix, meanwhile, opens a Windows File Explorer window from a web page and surreptitiously loads a disguised PowerShell command into their clipboard.
“When the victim pastes into the Explorer address bar, the malicious command executes,” researchers explained. “This attack relies not on software vulnerabilities but on exploiting routine user actions and trust.”
The researchers added that they have now observed known bad actors using FileFix in the wild. While the payloads are currently benign, they suggest this signals “an imminent shift to delivering real malware”.
“The rapid rise of the ClickFix technique in 2025 highlights that social engineering remains one of the most cost-effective and enduring methods cyber criminals use to breach defenses,” the researchers said.
“The fact that FileFix is already being tested and used in the wild mere days after its public disclosure shows how quickly attackers adopt new techniques and adapt to the evolving cyber threat landscape.”
Commenting on the Check Point findings, Dray Agha, senior manager of security operations at cyber security firm Huntress, said: “Threat actors [are] rapidly iterating to leverage foundational Windows workflows, making defenses that much harder to deploy”.
“By tricking users into 'pasting a path,' attackers execute malicious PowerShell without triggering standard warnings,” he added.
Agha warned that Huntress has also seen FileFix being used “aggressively in the wild, and it is succeeding in tricking users in huge numbers”.
How to protect yourself from FileFix
Check Point has laid out recommendations for security professionals to help protect against this attack, including:
- Monitoring phishing pages that mimic popular services and security verification screens, especially those using “Cloudflare-like” templates
- Implementing and fine-tuning detection rules to flag suspicious clipboard activity or unusual PowerShell executions triggered by user actions.
- Staying current with emerging social engineering trends and regularly updating user training, incident response plans, and security playbooks.
It also suggests encouraging “a culture of verification”, which will lead users to confirm unexpected or unusual requests with the relevant IT or security team before acting.
Users themselves should be “highly suspicious” of any web page or email that asks them to carry out unusual activity – especially copying and pasting.
They should also be educated that legitimate websites and software “rarely require manual execution of commands to fix issues”.
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
- Hackers are using fake tool installers to dupe victims
- Why social engineering is such a problem and how your business can protect itself
- Hackers are using PDFs to impersonate big brands in a new threat campaign
-
Marc Benioff isn’t convinced about the threat of AI job lossesNews Marc Benioff thinks fears over widespread AI job losses may be overblown and that Salesforce's own approach to the technology shows adoption can be achieved without huge cuts.
-
Neglecting printer security is leaving you wide open to cyber attacksNews Enterprises are ignoring printer security risks and failing to update, according to HP Wolf Security, leaving them vulnerable to cyber attacks.
-
MSPs emerge as key security partners for mid-market enterprisesNews The MSP Customer Insight Report reveals 85% of mid-sized organizations now rely on MSPs for security support
-
Application layer DDoS attacks are skyrocketing – here's whyNews The industry is seen as a prime target thanks to a reliance on online services and real-time transactions
-
Arrests made after huge HMRC scam campaign hit 100,000 accountsNews The Romanian nationals are accused of having used stolen data to make fraudulent claims
-
The ransomware boom shows no signs of letting up – and these groups are causing the most chaosNews Thousands of ransomware cases have already been posted on the dark web this year
-
Ingram Micro cyber attack: IT distributor says system restoration underway – but some customers might have to wait for a return to normalityNews Ingram Micro is gradually getting back on its feet after a recent cyber attack severely disrupted systems.
-
M&S chair calls for mandatory reporting of cyber attacks after "traumatic" ransomware incident – but will it do more harm than good?News M&S chair Archie Norman has called for mandatory reporting amid claims two large UK companies were hacked without any public knowledge.
-
Arrests made in hunt for hackers behind cyber attacks on M&S and Co-opNews The suspects remain in custody for questioning by officers from the NCA's National Cyber Crime Unit
-
Ransomware attacks carry huge financial impacts – but CISO worries still aren’t stopping firms from paying outNews Increased anxiety over ransomware links directly to its devastating impact on business processes and one’s bottom line
