FileFix in the wild! New FileFix campaign goes beyond POC and leverages steganography

**Executive summary:** Acronis TRU discovered an active, evolving FileFix/ClickFix phishing campaign that uses sophisticated obfuscation and steganography—embedding a second-stage PowerShell script and encrypted executables inside JPG images downloaded from benign-hosted locations—to deliver a Go-based loader which deploys the StealC infostealer targeting browsers, crypto wallets, messaging apps and cloud credentials; the report includes IoCs (hashes, IP 77.90.153.225, multiple domains), technical analysis, and mitigation recommendations.