New FileFix attack uses steganography to drop StealC malware

Acronis uncovered a FileFix campaign that impersonates Meta support to trick victims into pasting a disguised PowerShell command into the File Explorer address bar; the first-stage command downloads a JPG from Bitbucket containing a steganographically embedded second-stage PowerShell script which decrypts and loads the StealC infostealer in memory. StealC harvests browser credentials and cookies, messaging app creds, crypto wallets, cloud credentials, VPN/gaming app data, and can capture screenshots; multiple variants were observed over two weeks, and the campaign leverages detection-evasive techniques (clipboard obfuscation, absence of typical ClickFix markers, and in-memory payload decryption).