FileFix

FileFix is a social engineering technique in which the victim is tricked into pasting what looks like a harmless file path into the Windows File Explorer address bar — when in fact the clipboard holds an operating system command that executes the attacker's payload. It is a direct descendant of ClickFix, first documented by security researchers in mid-2025 and adopted by ransomware and infostealer operators within weeks.

How it works

The lure is typically a phishing page or email posing as a routine workflow: a shared document that "couldn't be displayed," an HR portal asking the employee to open a reviewed file, a security check requiring them to "locate" a path. The page offers a convenient copy button and step-by-step instructions — open File Explorer, paste, press Enter.

What gets copied is not the path shown on screen. The clipboard actually contains a command (commonly PowerShell) padded with spaces and a trailing comment so that only an innocent-looking file path is visible in the address bar. File Explorer happily executes commands entered there, so the victim launches the malware with their own hands, on their own session, with their own privileges. Because the user — not a malicious document or macro — performs the final action, the technique sidesteps many email attachment controls, and the initial download that security tools would normally flag may never happen at all.

FileFix matters because it confirmed a pattern rather than a one-off trick: ClickFix moved the execution step from the attacker to the victim via the Run dialog and terminal, and FileFix proved the same psychology transfers to any input surface that accepts commands. Wherever users can paste, attackers will supply something to paste.

How to defend against it

• Make "paste this to fix it" a named red flag. Train employees that no legitimate process — IT, HR, a document viewer, a CAPTCHA — ever asks them to copy something from a webpage into File Explorer, the Run dialog, or a terminal. Our ClickFix attacks guide covers the whole family.
• Hunt the parent-child pattern. Alert when explorer.exe spawns PowerShell or other script interpreters — rare in legitimate use, characteristic of FileFix.
• Reduce the blast radius. Constrain PowerShell for standard users and ensure endpoint detection inspects clipboard-sourced command execution.
• Reward reporting. A user who reports the strange "fix" page gives the security team the lure before it spreads.