JackFix Campaign: A New Wave of Fake Windows Update Malware

The JackFix campaign, identified by cybersecurity firm Acronis, employs sophisticated social engineering tactics to deceive users into executing malware through a convincing fake Windows Update screen. This campaign has been active since early October 2025 and primarily targets users via malvertising on adult websites, redirecting them to pages that mimic legitimate security updates.

JackFix Uses Fake Windows Update Pop-Ups on Adult Sites to Deliver Multiple Stealers

Upon visiting a compromised site, users are presented with a full-screen display resembling a Windows Update notification. The page instructs users to press specific key combinations, which triggers a sequence that leads to the execution of malicious commands. JavaScript on the page automatically copies these commands to the clipboard, facilitating the attack when users follow the on-screen instructions.

The initial stage of the attack utilizes the legitimate Windows component mshta.exe to execute JavaScript, which then launches a PowerShell script. This script is designed to download and execute additional payloads, including information-stealing malware such as LummaC2 and Rhadamanthys. The malware is cleverly concealed using steganography, with malicious code embedded within the pixel data of PNG images.

The Fake Update Screen That Makes You Install Malware YourselfHow-To GeekJackFix Uses Fake Windows Update Pop-Ups on Adult Sites to Deliver Multiple Stealers

The PowerShell script employed in the JackFix campaign is equipped with various obfuscation techniques to evade detection. It uses the Start-Process cmdlet to request administrative privileges, prompting users repeatedly until permission is granted. Once executed, the script can deploy multiple payloads, including remote access trojans (RATs) and information stealers.

JackFix Uses Fake Windows Update Pop-Ups on Adult Sites to Deliver Multiple Stealers

Researchers have noted that the malware delivery mechanism is particularly effective due to its reliance on user interaction. The attackers have refined their approach, utilizing a multi-stage delivery chain that complicates analysis and detection. The use of a .NET assembly known as the "Stego Loader" allows the malware to extract and execute hidden payloads in memory, further enhancing its stealth.

The Fake Update Screen That Makes You Install Malware Yourself

Experts have raised concerns about the effectiveness of the JackFix campaign, highlighting the psychological pressure it places on victims. The combination of a familiar Windows interface and the urgency of a supposed security update makes it difficult for users to discern the malicious intent. Security researchers emphasize that as operating systems improve their defenses, attackers are increasingly leveraging social engineering tactics to exploit human behavior.

The Fake Update Screen That Makes You Install Malware Yourself

In response to the JackFix campaign, cybersecurity professionals recommend several preventive measures. These include disabling the Windows Run dialog for non-technical users, monitoring for suspicious process chains involving mshta.exe and PowerShell, and training users to recognize and avoid executing commands from unknown sources. Organizations are encouraged to implement these strategies to mitigate the risks associated with such phishing attacks.

The Fake Update Screen That Makes You Install Malware Yourself

• “With the fake update screen, the attacker blends social engineering and technical execution in a way that’s nearly indistinguishable from a legitimate Windows process,” — Huntress Researchers

The Fake Update Screen That Makes You Install Malware Yourself

• “If only one of these payloads manages to run successfully, victims risk losing passwords, crypto wallets, and more," Kimhy said.” — Eliad Kimhy, Security Researcher

JackFix Uses Fake Windows Update Pop-Ups on Adult Sites to Deliver Multiple Stealers

• “Ultimately, while the use of steganography helps these payloads evade signature-based detection and complicates analysis, the attacks rely on a simple delivery mechanism: the victim manually opening the Windows Run box to paste a malicious command,” — Huntress Researchers

The JackFix campaign exemplifies the evolving landscape of cybersecurity threats, where attackers increasingly rely on social engineering to bypass technical defenses. As these tactics become more sophisticated, it is crucial for users and organizations to remain vigilant and adopt proactive security measures to protect against such deceptive schemes.

The Fake Update Screen That Makes You Install Malware Yourself