FileFix phishing and AI-driven malware: why browser credentials are at risk

At a glance

What this is: This is Anomali’s roundup of current threat activity, centered on phishing, AI-assisted intrusion tooling, supply-chain style delivery, and AI agent abuse.

Why it matters: It matters because the campaigns all intersect with credentials, browser data, privileged access, or delegated AI access, which means identity teams and security operations need to treat user execution and trust boundaries as a shared control problem.

By the numbers:

• 17 minutes.
• 27 days
• Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.

👉 Read Anomali's roundup of FileFix phishing, AI-driven pentesting, and ShadowLeak

Context

Phishing, infostealers, and AI-assisted intrusion tooling keep succeeding because they target the weakest operational boundary in many environments: user trust. FileFix works by turning a copy-and-paste moment into command execution, while StealC then harvests browser data, cloud credentials, and messaging artifacts. That is an identity problem as much as a malware problem, because the attack chain depends on the victim’s authenticated sessions and stored secrets.

The broader pattern is that attackers are increasingly using automation, obfuscation, and AI to compress the time between delivery and exploitation. ShadowLeak shows that AI agents connected to mail or enterprise data can become exfiltration paths, while Scattered Spider demonstrates how social engineering still scales when privileged reset processes remain easy to abuse. The starting position is not unusual; it is a common enterprise weakness.

These threats cross human identity, NHI, and agentic AI boundaries. Browser-stored credentials, cloud secrets, delegated resets, and inbox-connected agents all create pathways where one compromised trust relationship can expose several others.

Key questions

Q: How should security teams reduce the risk of clipboard-based phishing leading to code execution?

A: Security teams should disable or restrict risky script paths, monitor for suspicious parent-child process chains, and train users that copy-and-paste into Explorer can execute commands. Endpoint controls need to be paired with behavioural detections, because the attacker is abusing legitimate user interaction rather than exploiting a software flaw.

Q: Why do browser-stored credentials increase the impact of infostealer malware?

A: Browsers often store session cookies, saved passwords, and cloud login artifacts in one place, so a single infostealer can unlock multiple accounts at once. That turns endpoint compromise into identity compromise. The risk is highest where cloud consoles, messaging, and developer tools are reachable from the same browser profile.

Q: What do security teams get wrong about AI agents connected to email or enterprise data?

A: They often assume the agent is only reading trusted content, when in reality the content itself can carry malicious instructions. If the agent can interpret inbox data and transmit results externally, it can become an exfiltration path. Teams need explicit data boundaries, output controls, and logging.

Q: What should organisations do first when they see evidence of stolen cloud credentials or session cookies?

A: They should revoke the affected sessions, rotate any exposed secrets, and review downstream access for privilege escalation or lateral movement. If the credential came from a browser or infostealer incident, assume the attacker may already have used it and move quickly to containment and authentication reset.

Technical breakdown

How clipboard-based phishing turns user execution into code execution

FileFix-style attacks exploit a simple but effective trust shortcut. A user copies what looks like a file path into Windows File Explorer, but the clipboard content actually contains a PowerShell command. Explorer then becomes the launch point for execution, which means the malicious action is initiated by a legitimate user interaction rather than by a traditional exploit chain. Once PowerShell runs, the campaign can fetch staged content, unpack payloads, and hide the next steps behind standard Windows behaviour. This is why monitoring only inbound email or known malware hashes is not enough; the dangerous step is often the handoff from user action to script execution.

Practical implication: restrict PowerShell where possible and watch for unusual child processes launched from Explorer.

Why steganography and obfuscation slow detection of infostealer delivery

Steganography hides malicious content inside benign-looking files, such as a JPG carrying encrypted script material. In the FileFix campaign, the payload chain used a Bitbucket-hosted image, decrypted executables, and string obfuscation to make static inspection harder. This matters because defenders often key off file reputation, file type, or obvious script indicators, yet hidden payloads bypass those assumptions. The result is not invisibility, but delay. Detection and triage become slower, which gives the attacker more time to harvest browser-stored credentials, cloud tokens, and messaging data before response begins.

Practical implication: add behavioural detection for hidden script extraction and unusual archive or image handling.

How AI-connected inbox access becomes a data exfiltration channel

ShadowLeak illustrates a server-side trust failure in AI agent design. The agent was allowed to read inbox content and act on instructions embedded inside that content, including hidden HTML. That means the model was not just summarising data, it was also consuming attacker-controlled prompts as operational input. When an AI agent can read, interpret, and transmit content without strict validation, the agent becomes part of the attack path. The architectural issue is delegation without robust boundary checking: the AI system inherits the trust of the mailbox, but not the security controls that normally govern sensitive data movement.

Practical implication: constrain what connected agents can read, process, and exfiltrate, then audit every external transmission.

Threat narrative

Attacker objective: The attacker wants to turn a single trust lapse into credential theft, session abuse, and downstream access to cloud, messaging, or identity-controlled resources.

1. Entry begins with phishing or social engineering, such as a clipboard trick, a fake login page, or an attacker-controlled email delivered into an AI-connected inbox.
2. Escalation occurs when the victim executes PowerShell, a phished session is reused, or a delegated agent follows hidden instructions and gains access to browser data, cloud credentials, or internal messages.
3. Impact follows when stolen credentials, session cookies, or exfiltrated inbox data are used for account takeover, deeper access, or further intrusion against cloud and identity systems.

Breaches seen in the wild

• Shai Hulud npm malware campaign — Shai Hulud campaign: npm malware exposed secrets on GitHub.
• CoPhish OAuth Token Theft via Copilot Studio — CoPhish campaign exploits Microsoft Copilot Studio agents to steal OAuth tokens via AI-assisted phishing.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Browser-stored credentials remain an under-governed identity layer: Stealers such as StealC target browser data because browsers now hold session state, saved credentials, and authentication artifacts that bypass many password hygiene assumptions. That makes the browser a credential warehouse, not just an endpoint application. IAM and PAM teams need to treat browser session material as privileged exposure, especially where cloud consoles and developer tools are accessible from the same profile.

Shadow AI creates a new trust boundary problem for identity teams: AI agents connected to email or enterprise data can become unmonitored intermediaries between humans and sensitive systems. The issue is not just model output quality, but delegated access scope, hidden instructions, and invisible exfiltration paths. This is where AI governance and identity governance intersect directly: if an agent can read it, it can often leak it unless controls are explicit.

Identity abuse is still the cheapest attack path, even when the tooling looks advanced: FileFix, Scattered Spider, and RaccoonO365 all show that attackers keep winning by exploiting reset workflows, copy-and-paste behaviour, and trust in familiar interfaces. The named concept here is trust-boundary collapse, meaning one user action or one delegated access grant can collapse multiple control layers at once. Practitioners should assume identity workflow abuse will remain the highest-leverage entry point.

AI-enabled offensive tooling lowers the skill barrier without changing the underlying risk: Villager and similar frameworks matter because they compress reconnaissance, exploitation, and post-exploitation into repeatable workflows. That does not make every attacker more sophisticated, but it does make more attacks operationally feasible. Security teams should expect higher volume, faster iteration, and less predictable targeting, which makes exposure management and identity containment more important.

Secrets governance is still the control that determines blast radius: Once StealC or a similar infostealer reaches browser-stored cloud credentials, the attacker’s next step is shaped by whether secrets are short-lived, scoped, and monitored. This is exactly the kind of gap OWASP NHI guidance and NIST-aligned identity controls are meant to reduce. The practitioner conclusion is simple: limit what a stolen token can do, then assume it will eventually be stolen.

From our research:

• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
• DeepSeek accidentally embedded over 11,000 secrets in its training data and left a database exposed online, revealing more than one million sensitive records including chat histories, backend credentials, and API keys, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
• For a broader breach pattern view, see The 52 NHI breaches Report for real-world cases where exposed identity material widened attack scope.

What this signals

The programme signal is clear: endpoint security, IAM, and AI governance can no longer be managed as separate lanes when the attack path crosses browsers, inboxes, and delegated agents. Trust-boundary collapse is now the practical failure mode to watch, because one user interaction or one connected agent can bridge multiple controls at once. Teams should align detection, access governance, and data-exfiltration monitoring around that shared failure pattern.

Credential exposure is also still a race against the attacker’s clock, not the defender’s review cycle. Once cloud or browser credentials leak, the response window narrows dramatically, which is why short-lived secrets, session revocation, and first-use monitoring need to be operational defaults rather than exception handling. For identity-led programmes, that means building containment playbooks that assume compromise before certainty is achieved.

For AI-adjacent environments, the next control question is not whether the model is accurate enough, but whether it is authorised to see, interpret, and forward sensitive content at all. Agent permissions should be segmented with the same discipline used for service accounts and privileged workflows, then mapped against frameworks such as the MITRE ATLAS adversarial AI threat matrix when prompt injection or tool misuse is in scope.

For practitioners

• Harden user-to-code execution paths Block or tightly constrain PowerShell execution from user-driven paths such as Explorer, and alert on suspicious parent-child process chains that begin with file browsing.
• Treat browser sessions as sensitive identity assets Reduce dependence on saved browser credentials and session persistence for cloud and admin portals, especially on endpoints used for messaging and developer work.
• Verify every delegated identity reset out of band Require independent confirmation for password resets, MFA resets, and admin role changes, then log the approver, channel, and source of request for auditability.
• Constrain AI agents connected to inboxes and repositories Limit the content agents can read, the systems they can query, and the destinations they can send to, then review logs for hidden-prompt abuse and unusual exfiltration patterns.
• Scope and rotate exposed secrets aggressively Assume any leaked token, API key, or cloud credential can be used within minutes, so shorten validity, reduce privilege, and monitor for first-use from new locations.

Key takeaways

• Phishing is still evolving into identity compromise, not just malware delivery, because attackers are using browser sessions, cloud tokens, and delegated resets as the real payloads.
• The speed of credential abuse leaves very little room for manual review, so containment depends on immediate revocation, tighter scope, and better visibility into first use.
• AI agents connected to inboxes or repositories need explicit trust boundaries, or they will become another exfiltration path rather than a productivity layer.

Key terms

• Clipboard Injection: A phishing technique that uses copy-and-paste behaviour to deliver malicious commands or data instead of a harmless-looking string. It exploits user trust in familiar interfaces and can turn a routine desktop action into script execution without a browser exploit or attachment macro.
• Steganography: A method of hiding malicious content inside another file type, such as embedding a script inside an image. The file may appear benign during casual inspection, but the hidden payload can be extracted later to continue an attack chain while evading simplistic detection rules.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Session Cookie Theft: The capture of browser session data that proves an already authenticated user. Once stolen, the cookie can let an attacker impersonate the victim without repeating the login step, which makes session assurance and replay resistance critical to identity security.

What's in the full analysis

Anomali's full post covers the operational detail this analysis intentionally leaves for the source:

• Campaign-by-campaign IOCs and detection context for FileFix, Villager, and ShadowLeak.
• MITRE ATT&CK mappings for the specific intrusion stages and post-exploitation behaviours described in the source.
• Analyst commentary on why these campaigns are converging on identity, browser, and AI trust boundaries.
• The original roundup framing that situates each item in Anomali's current threat watch format.

👉 Anomali's full post covers the campaign details, ATT&CK mappings, and analyst commentary behind each threat.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners build the access, lifecycle, and oversight discipline that modern identity programmes now require.