{"success":true,"data":{"id":"filefix-explorer-address-bar-paste-lure","label":"FileFix address-bar paste lure — mr.d0x ClickFix variant targeting Windows File Explorer: email instructs victim to press Ctrl+L (or click \"Open File Explorer\"), paste a disguised PowerShell/mshta command into the address bar, and press Enter. Payload is whitespace-padded so only a fake file path shows in the UI (Check Point + Kaspersky + Intel 471 + BleepingComputer Jun 2025 → Mar 2026; Expel Labs cache-smuggling variant Dec 2025; StealC v2 payload)","description":"Email directing the recipient to press Ctrl+L in Windows File Explorer (or click \"Open File Explorer\"), then paste a \"file path\" into the address bar and press Enter. The pasted string is a disguised PowerShell, mshta, or rundll32 one-liner: the real payload is prefixed with hundreds of whitespace characters so the UI only shows a fake-looking path (`\\\\server\\team\\docs\\report.pdf`) while Enter executes the command. FileFix was disclosed by mr.d0x in June 2025 and turned up in live campaigns within two weeks — documented by Check Point, Kaspersky, Intel 471, BleepingComputer. Expel Labs disclosed a cache-smuggling variant with a JPG-hidden PowerShell payload dropping StealC v2 in December 2025; FileFix 2.0 with Mark-of-the-Web bypass landed by March 2026. Distinct from the Win+R ClickFix family because the UI affordance is different (File Explorer rather than the Run dialog). No legitimate workflow requires pasting anything into File Explorer's address bar to \"open\" an email attachment.","tier":"danger","category":"other","isThin":false}}