FileFix global phishing campaign
Campaign
Summary
Hide ▲
Show ▼
The FileFix phishing campaign has expanded into a global credential-theft operation, reaching users across multiple countries and languages. It uses malicious PowerShell, steganography, and a fake Facebook security appeal flow to trick victims into executing code. The lure was translated into at least 16 languages, suggesting broad international targeting. The payload chain ultimately delivers StealC, raising the risk of password and wallet theft.
Related Happenings
AccountDumpling Google AppSheet Facebook phishing campaign
Campaign
H score31
First: 01.05.2026 21:09
Last: 01.05.2026 21:09
Sources 1
About this happening:
A Vietnamese-linked operation dubbed AccountDumpling is using Google AppSheet as a phishing relay to steal Facebook credentials, enabling account takeover at scale...
AccountDumpling Google AppSheet Facebook phishing campaign
CampaignAbout this happening: A Vietnamese-linked operation dubbed AccountDumpling is using Google AppSheet as a phishing relay to steal Facebook credentials, enabling account takeover at scale...
Compromised legitimate WordPress websites used to infect visitors with infostealer malware campaign expands across multiple victims
Campaign
H score34
First: 11.03.2026 16:45
Last: 11.03.2026 16:45
Sources 1
About this happening:
A global ClickFix campaign is abusing compromised WordPress sites to push infostealer malware to visitors, putting credentials and financial data at risk. The operatio...
Compromised legitimate WordPress websites used to infect visitors with infostealer malware campaign expands across multiple victims
CampaignAbout this happening: A global ClickFix campaign is abusing compromised WordPress sites to push infostealer malware to visitors, putting credentials and financial data at risk. The operatio...
CRESCENTHARVEST Windows RAT and info-stealer activity
Malware Activity
H score28
First: 19.02.2026 10:13
Last: 19.02.2026 10:13
Sources 1
About this happening:
The CRESCENTHARVEST malware activity centers on version.dll, a Windows RAT and information stealer that can execute commands, log keystrokes, and exfiltrate data. It m...
CRESCENTHARVEST Windows RAT and info-stealer activity
Malware ActivityAbout this happening: The CRESCENTHARVEST malware activity centers on version.dll, a Windows RAT and information stealer that can execute commands, log keystrokes, and exfiltrate data. It m...
Storm-0249 tax-themed phishing campaign targeting U.S. users
Campaign
H score29
First: 09.12.2025 15:37
Last: 09.12.2025 15:37
Sources 1
About this happening:
Storm-0249 ran a tax-themed phishing campaign against U.S. users ahead of the tax filing season, expanding access opportunities for downstream abuse. The operation...
Storm-0249 tax-themed phishing campaign targeting U.S. users
CampaignAbout this happening: Storm-0249 ran a tax-themed phishing campaign against U.S. users ahead of the tax filing season, expanding access opportunities for downstream abuse. The operation...
JackFix ClickFix fake-adult-site phishing campaign
Campaign
H score35
First: 25.11.2025 16:18
Last: 25.11.2025 16:18
Sources 1
About this happening:
The JackFix campaign is using fake adult websites and ClickFix lures to trick users into running malicious commands, enabling an infection chain that can drop steale...
JackFix ClickFix fake-adult-site phishing campaign
CampaignAbout this happening: The JackFix campaign is using fake adult websites and ClickFix lures to trick users into running malicious commands, enabling an infection chain that can drop steale...
Timeline
-
16.09.2025 15:00 2 articles · 10mo ago
FileFix phishing campaign disclosed with global reach and StealC payload
Initial DisclosureAcronis researchers observed a mature FileFix phishing operation that impersonates Facebook security, uses malicious PowerShell, code obfuscation, and steganography, and delivers a hidden StealC infostealer payload to steal passwords and other sensitive data. VirusTotal uploads indicate broad reach across countries including the US, the Philippines, Bangladesh, Tunisia, the Dominican Republic, Germany, China, Peru, Nepal, and Serbia, and the lure was localized into at least 16 languages.
Show sources
- Innovative FileFix Phishing Attack Proves Plenty Potent — www.darkreading.com — 16.09.2025 15:00
- Innovative FileFix Phishing Attack Proves Plenty Potent — www.darkreading.com — 16.09.2025 15:00