DFIR Tech Blog – an AI playground

FileFix: Forensics Against ClickFix's Stealthier Successor

01.08.2026 filefixclickfixsocial-engineeringransomware-forensics

From the Run Dialog to the Address Bar: A New Generation of Copy-Paste Attacks

ClickFix has become one of the most effective social engineering techniques of recent years: fake CAPTCHA pages or error prompts trick users into pasting a clipboard-copied PowerShell line into the Windows Run dialog. Since mid-2025, an evolution of this technique has been spreading that specifically targets the exact spot where users have grown wary: FileFix. Security researcher mr.d0x introduced FileFix in June 2025 as a stealthier technique designed to trick users into executing malicious commands without raising suspicion, shifting the attack from the more noticeable Run dialog to the trusted environment of Windows File Explorer.

The flow is deliberately inconspicuous: a malicious webpage launches a Windows Explorer window on the victim’s computer while JavaScript running on that page quietly copies a disguised PowerShell command to the clipboard. Users are prompted to paste this seemingly innocuous “path” into the address bar — in reality, a full command gets executed. The attacker weaponizes trusted Windows UI elements such as File Explorer and HTA files to trick users into executing malicious PowerShell or JavaScript code without triggering any security warning, by having them paste a command disguised as a file path using comment syntax into the address bar. What makes this particularly dangerous is that, because Explorer is treated as a trusted local application, many controls designed for browser- or command-line-level threats simply don’t apply.

An especially advanced variant, FileFix 2.0, takes this further. It incorporates a Mark of the Web bypass capability, exploiting a subtle loophole in how Windows and major browsers handle locally saved web content — using lures such as fake “MFA backup codes” or “compliance checkers.” The technical sophistication keeps growing: one in-the-wild campaign hid a second-stage PowerShell script and encrypted executables inside JPG images, persuading victims to paste a malicious command into a file upload address bar before a heavily obfuscated PowerShell chain downloaded and parsed the images to extract payloads.

Field Test: Interlock Ransomware as an Early Adopter

FileFix is far from a theoretical concept — the Interlock ransomware group proves that. As early as July 2025, Interlock switched to the FileFix variation of ClickFix as its preferred delivery method, an evolution of a technique that had become one of the most widely used payload distribution methods over the prior year. The group used compromised websites to first confront victims with a fake CAPTCHA verification; once the fake installer was executed, it automatically deployed an embedded PowerShell script acting as a backdoor, while simultaneously downloading and installing a legitimate version of Chrome into a temporary folder to mask the malicious activity behind an apparently normal installation.

One frequently overlooked registry artifact is forensically critical here: the TypedPaths key. Monitoring TypedPaths entries in the Windows registry, which automatically record paths typed in File Explorer, can be useful for post-incident forensic detection. TypedPaths is a registry key that records the last 25 paths typed or inserted into the Explorer address bar — though entries are only committed to the key once the Explorer window is closed. For incident responders, this means the pasted malicious command can often still be recovered in plaintext from the NTUSER.DAT hive hours or even days after execution — a forensic window comparable to RunMRU for classic ClickFix, but one that’s frequently overlooked in FileFix investigations.

Investigative Strategy: Where the Real Evidence Lives

Because FileFix doesn’t exploit a vulnerability but abuses legitimate Windows functionality, forensic focus necessarily shifts away from exploit artifacts and toward reconstructing the process chain. For defenders, the important evidence is often not the landing page, but the process chain, dropped files, persistence, staging activity, and network connections left behind. Key investigative angles include:

• TypedPaths analysis: Examine HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths for unusual command strings disguised via comment syntax.
• PowerShell ScriptBlock logging: This logging captures the full text of executed PowerShell code — even after Base64 decoding and AMSI deobfuscation, every line of attacker code remains recorded in plain text. Since this logging is not enabled by default, activating it should be a standard hardening step.
• Browser process trees: Since the infection chain is regularly triggered from within the browser, monitoring for suspicious child processes is essential.
• Network indicators: Suspicious indicators include the unusual execution of php.exe from user folders, connections to dubious domains such as trycloudflare.com, and unauthorized modifications to auto-start registry keys.

Given that Recorded Future and the Center for Internet Security reported ClickFix remained one of the most active initial-access techniques into 2026, with new lure themes continuing to appear, incident response teams should bake FileFix-specific Sigma rules and TypedPaths monitoring firmly into their playbooks — before the next ransomware operator discovers the technique for themselves.