FileFix Attack Chain Enables Malicious Script Execution

A researcher disclosed a FileFix/ClickFix attack chain that uses social engineering to get victims to save malicious webpages as .HTA or paste PowerShell commands, bypassing Windows Mark of the Web protections and auto-executing scripts via mshta.exe; the technique has been observed in widespread website compromises (thousands of WordPress sites and over 100 car dealership sites) and can be mitigated by disabling mshta.exe, showing file extensions, and blocking HTML attachments.