Meta account‑suspension scam deploys FileFix malware

Researchers at Acronis disclosed a phishing campaign called FileFix that impersonates Meta support and tricks victims into pasting a disguised PowerShell command into the Windows File Explorer address bar. The command fetches an obfuscated payload (staged on Bitbucket) that ultimately installs the StealC infostealer, which harvests browser credentials, authentication cookies, messaging‑app data, cryptocurrency wallets and cloud credentials (AWS/Azure). The tactic—credited to a Red Team researcher known as mr.d0x—has been observed in multiple rapidly evolving variants and poses a direct threat to Facebook/Instagram users and organizations relying on compromised credentials.