FileFix phishing and AI-driven malware: why browser credentials are at risk

At a glance

What this is: This Anomali analysis links FileFix phishing, StealC delivery and related AI-enabled abuse to a broader rise in browser credential theft and trust boundary exploitation.

Why it matters: It matters because browser-stored credentials, session material and cloud tokens are increasingly harvested through user execution, which weakens both human identity controls and NHI governance.

Context

Phishing has moved beyond simple credential capture and now routinely chains user deception into script execution, staged payload delivery and downstream theft of browser-stored secrets. In this case, the core governance problem is that the browser and file explorer are being treated as safe interaction surfaces even though they can be converted into execution paths.

For identity teams, the key issue is not just password theft but the abuse of browser sessions, cloud credentials and other secrets that sit outside traditional login controls. For AI and security teams, ShadowLeak and Villager show that trust boundaries are also being tested by AI-enabled workflows and agentic misuse, so the control model has to extend beyond the login screen.

Key questions

Q: What breaks when clipboard phishing reaches the browser and file explorer?

A: The failure is the assumption that user-interface actions are harmless until they touch a browser or email client. In reality, a copied path or pasted command can launch code, retrieve payloads and expose secrets before traditional phishing controls ever see a credential prompt. Defenders need to watch execution lineage, not just message content.

Q: Why do browser-stored credentials increase risk in enterprise environments?

A: They increase risk because they place valuable credentials inside a user-centric storage layer that can be exposed through endpoint compromise, browser profile theft, sync abuse, or exported files. The issue is not just theft. It is the absence of enterprise governance around secrets that should be tracked, approved, and revocable.

Q: What are the signs that an infostealer campaign is trying to maintain long term access to a browser session?

A: Common warning signs include repeated session reauthentication failures, unusual cookie creation or reuse, suspicious browser traffic, and new logins from unexpected IP addresses or proxy infrastructure. In this article, attackers also used SOCKS proxies and token manipulation to bypass IP based restrictions. Those patterns suggest the goal is durable session hijacking rather than one time access.

Q: How should security teams govern AI services that can generate offensive content?

A: Security teams should govern offensive-capable AI services like any other high-risk non-human identity. That means explicit ownership, least privilege, approved use cases, logging of prompts and outputs, and a ban on production influence unless the service is separately reviewed and constrained. If the service can guide attacks, it needs policy enforcement outside the prompt.

Technical breakdown

How clipboard-based phishing turns file explorer into an execution path

FileFix works because the victim is persuaded to copy what looks like a harmless file path into Windows File Explorer, but the clipboard actually contains a PowerShell command. That command retrieves a JPG from a remote repository, and the image hides the next-stage script through steganography. Once extracted, the script decrypts embedded payloads and runs them without needing an obvious attachment or macro. The technique combines social engineering, command execution and payload obfuscation into one chain, which makes static detection much harder than with ordinary phishing links. The browser is often the first place secrets live, but Explorer becomes the bridge to code execution.

Practical implication: Monitor Explorer spawned PowerShell and block or heavily constrain script execution from user-driven clipboard workflows.

Why steganography and obfuscation complicate detection

Steganography hides code inside benign-looking media, while obfuscation fragments or encrypts strings so signatures cannot easily match them. In the FileFix campaign, the initial JPG carries the hidden script, and the delivery path uses encrypted URLs and heavy string manipulation to reduce visibility. This is not just evasive coding. It is a way to separate the visible lure from the real payload, which means traditional email or web filtering may see only the harmless surface. Security teams need to think about where execution is initiated, not just where the original lure was delivered, because the malicious content may not be obvious until after it has already started running.

Practical implication: Use script telemetry and child-process monitoring to spot hidden execution that evades content-based scanning.

Why browser credential theft is now a primary objective

StealC is valuable because it harvests browser data, cloud credentials, crypto wallets and messaging artifacts in one pass. That makes the browser a high-yield collection point for both human identity and machine identity material. The article also connects this pattern to Scattered Spider’s account manipulation, Villager’s automation of intrusion work and ShadowLeak’s AI agent abuse, which together show a wider trend: attackers want secrets that can be reused across SaaS, cloud and collaboration services. The real problem is not a single stolen password, but the breadth of access that browser state can expose once trust is broken.

Practical implication: Treat browser-stored credentials as a governed secret class and reduce reliance on persistent session material.

Threat narrative

Attacker objective: The attacker wants to convert a single user interaction into durable access to browser-stored secrets, cloud credentials and other reusable identity material.

1. Entry begins with multilingual phishing pages that impersonate Meta and induce the user to copy a malicious command from the page into File Explorer.
2. Credential harvesting follows once the StealC infostealer runs, collecting browser data, cloud credentials, crypto wallets and messaging artifacts from the endpoint.
3. Impact occurs when those secrets are reused across cloud and collaboration services, creating account compromise and broader identity exposure.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• EmeraldWhale Git config credential theft: Tokens in exposed .git/config files let EMERALDWHALE clone private repositories and steal more than 15,000 cloud credentials.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Browser credential theft is now an identity governance problem, not just an endpoint problem. When browsers hold cloud credentials, session state and messaging artifacts, compromise of the browser becomes compromise of the identity boundary. That shifts the control discussion from account login alone to how secrets are stored, replayed and reused across services. Practitioners should treat browser-derived access as governed identity material, not incidental endpoint data.

FileFix is a named example of the clipboard trust gap. The attack works because users still assume that a copied file path is inert and that File Explorer is a safe shell for routine navigation. In practice, that assumption collapses when Explorer can launch PowerShell and retrieve hidden payloads. The practitioner conclusion is simple: user interface trust is now part of the attack surface.

ShadowLeak and Villager show that AI is widening the same trust boundary problem. One abuse path hides instructions inside content that an agent later processes, while the other wraps intrusion activity in automation that lowers attacker skill requirements. The common failure mode is delegated trust without tight boundary checks. Teams should assume that any workflow that can read, decide and act may also be persuaded, poisoned or abused.

Stealth at the payload layer is becoming as important as stealth at the identity layer. Steganography, obfuscation and encrypted delivery paths let attackers move faster than content filters and many SIEM detections. That means defensive maturity is less about catching known file hashes and more about spotting unusual execution lineage and secret access patterns. The practitioner takeaway is to align telemetry, identity controls and runtime policy around suspicious post-delivery behavior.

Browser secrets deserve explicit lifecycle governance. Browser-stored tokens, cloud credentials and wallet data are often outside the ownership model used for service accounts or privileged access. This leaves a gap between who can read the secret, who can use it and who is responsible for revocation after compromise. Teams should classify browser secrets as managed credentials with clear ownership and response paths.

From our research library:

• The IBM/Ponemon 2025 Cost of a Data Breach Report found that phishing-initiated breaches cost an average of $4.8M each.

What this signals

Browser secrets are becoming a governed credential class. The practical change is that defenders must treat browser-stored tokens, session cookies and cloud credentials as assets with owners, revocation paths and monitoring, not as accidental by-products of user activity. When infostealers target the browser, the recovery problem becomes an identity problem.

Hidden execution paths are now a control design problem. FileFix and similar campaigns succeed because the malicious step is buried behind normal-looking user interaction. That means control design has to focus on shell-to-script lineage, paste-to-execute behavior and endpoint telemetry that ties user action to downstream code execution.

ShadowLeak sharpens the same lesson for AI assistants. Any agent that can read inboxes or documents can also be manipulated through content it consumes, so the trust boundary has to sit at ingestion and egress, not only at the model prompt. For practitioners, this is a reminder that AI governance and identity governance are now overlapping disciplines.

For practitioners

• Constrain PowerShell execution from user-driven browser workflows Block or severely limit PowerShell launched from Explorer and other user-facing shell contexts, then alert on child-process chains that start from browser or file explorer activity.
• Baseline and hunt for browser secret collection Monitor for infostealer indicators that target browser stores, cloud token caches and messaging artifacts, and prioritise hosts that access multiple SaaS platforms from the same session.
• Treat clipboard-driven lures as high-risk user execution paths Train users that copied file paths, pasted commands and file explorer prompts can be weaponised, and pair that awareness with controls that suppress risky paste-to-execute behaviour.
• Reduce dependence on persistent browser sessions Shorten session lifetimes where practical, require reauthentication for sensitive actions and revoke tokens quickly when an endpoint shows infostealer behavior or suspicious script execution.
• Tighten agent and inbox trust boundaries For AI assistants that read mail or documents, restrict what content they may ingest, validate outputs before transmission and log each interaction for later review.

Key takeaways

• FileFix-style phishing shows that a single user interaction can pivot from a clipboard lure into code execution and browser credential theft.
• The broader pattern extends beyond one campaign because AI-enabled abuse, infostealers and hidden instructions all exploit trust assumptions that defenders still treat as safe.
• Teams reduce exposure by governing browser secrets, watching execution lineage and constraining any workflow that can read and act on content.

Key terms

• Steganography: Steganography is the practice of hiding data inside another file so the outer file still looks normal. In malware operations, images, audio, or documents can carry concealed payload bytes that are only revealed when a custom extraction routine reads the file in a specific way.
• Infostealer: An infostealer is malware built to collect credentials, session material, tokens, and other authentication data from infected systems. In NHI programmes, the risk is not only theft but reuse, because harvested workload secrets can unlock cloud access long after the initial infection.
• Browser-Stored Credentials: Browser-stored credentials are usernames, passwords, tokens, or session artifacts saved in a web browser for convenience. They become a security risk when malware or an attacker with endpoint access can extract them and use them to bypass normal login controls.
• Indirect Prompt Injection: Indirect prompt injection is an attack where malicious instructions are hidden inside content that an AI system reads later. The model may treat that content as context rather than as hostile input, which can influence tool use, data access, or workflow actions if controls are weak.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps practitioners connect identity controls to the wider security programme they run.