ClickFix Spin-Off Attack Bypasses Key Browser Safeguards

A security researcher disclosed "FileFix 2.0," a technique that abuses Chrome/Edge save-as behavior to omit Mark of the Web metadata and trick users into saving malicious HTML/HTA files that can execute arbitrary code (via mshta, PowerShell, etc.). The attack uses social-engineering lures (e.g., fake backup-code pages) to induce users to save and run files; mitigations include preventing mshta from running, monitoring for suspicious child processes, and training users to avoid saving/running files from untrusted pages.