New FileFix attack runs JScript while bypassing Windows MoTW alerts

A new FileFix attack variant abuses browser behavior when saving pages as "Webpage, Complete" (MIME type text/html) so the saved file lacks the Mark of the Web; if a user is tricked into renaming that file to .HTA, mshta.exe will immediately execute embedded JScript without Windows warnings. The report explains the attack flow, social engineering baits (for example persuading users to save MFA backup codes), and suggests mitigations including disabling/removing mshta.exe, enabling file extension visibility, and blocking HTML attachments.