fahrzeugvergabe.de: a German FileFix page that made visitors paste a PowerShell command, and what to do if you did

What fahrzeugvergabe.de is, and what we know about it

fahrzeugvergabe.de is not a program on your PC. It is a German web address that the abuse.ch project URLhaus lists three times for malware delivery, with the tags ClickFix and FileFix. Those two names describe a trick, not a virus: a web page talks you into pasting a command into Windows yourself. We found no public write-up of this one address, so what follows is what URLhaus shows, what our server saw, and what Microsoft and security researchers have published about the trick.

1. 1

   What URLhaus lists

   Three addresses on the site: the home page, a page called unterlagen.html and an address ending in /api/cm-token. All three were added on 3 October 2026 within four seconds of each other, at about 09:10 UTC, by the reporter YoshmanSJ. All three carry the threat label malware_download, and all three are now marked offline.

2. 2

   What the tags mean

   ClickFix and FileFix are the names of the paste trick. Loader means the command fetches a program whose job is to bring in more malware. powershell names the Windows tool the command runs in, exe says a Windows program file was involved, and DEU marks the report as German. The tags come from the reporter; URLhaus shows them, it does not prove them.

3. 3

   What the names suggest

   Fahrzeugvergabe means vehicle allocation or vehicle award in German, and Unterlagen means documents. Our reading is that the page posed as a German service handing out documents about a vehicle, a tender or a fleet contract, and asked the visitor to open those documents through File Explorer. No report we read describes the page itself, so treat this as our reading of the names, not as a fact.

4. 4

   What this means for you

   Opening the page alone did not infect anyone, as far as every source on ClickFix and FileFix says. The harm starts when a visitor follows the instructions: copies a text, opens File Explorer or the Run box, pastes and presses Enter. If you did that, read the check and cleaning sections below. If you only saw the name in a log or a warning, nothing is proven.

Kind of threat

A FileFix and ClickFix page: a fake document or check page that makes you paste a PowerShell command into Windows, which then fetches a loader

Reported addresses

hxxps://fahrzeugvergabe[.]de/, hxxps://fahrzeugvergabe[.]de/unterlagen.html and hxxps://fahrzeugvergabe[.]de/api/cm-token

URLhaus entries

3, all added on 3 October 2026 at about 09:10 UTC by YoshmanSJ; all 3 offline when we read our copy on 8 October 2026

Registration

Not known. Our RDAP lookup on 8 October 2026 returned no record for the name, so we cannot give a creation date or registrar

Our test

A plain request from our server on 8 October 2026 failed: the name did not resolve in DNS (ENOTFOUND)

Platform

Windows. The tags name PowerShell and an exe file. The same trick exists for Mac, but nothing in these reports points to a Mac version

What we checked on 8 October 2026, and what we could not

We sent one plain request to fahrzeugvergabe.de from our server on 8 October 2026. It did not reach any server: the lookup of the name failed with getaddrinfo ENOTFOUND, which means DNS no longer points the name anywhere. A site that is gone today tells you nothing about what it did on 3 October.

What happened to fahrzeugvergabe.de, from the reports to our check

The whole story we can see fits into five days. The dates come from the URLhaus data we hold and from our own request; the times are UTC.

1. Before 3 October 2026

   Registration, date not known

   Our RDAP lookup gave no record, so we cannot say when fahrzeugvergabe.de was registered or who the registrar is. The .de registry, DENIC, publishes very little about private holders.

2. 3 October 2026, 09:10:11 UTC

   The document page is reported

   URLhaus adds hxxps://fahrzeugvergabe[.]de/unterlagen.html with the tags ClickFix, DEU, exe, FileFix, Loader and powershell. Unterlagen is German for documents.

3. 3 October 2026, 09:10:12 UTC

   The home page is reported

   One second later the home page itself is added with the same six tags and the threat label malware_download.

4. 3 October 2026, 09:10:14 UTC

   The api/cm-token address is reported

   Two seconds after that, hxxps://fahrzeugvergabe[.]de/api/cm-token is added with the same tags. Its role is not explained in the report. Our reading is that the page called this address to get the next piece of the attack, but we did not see it.

   

5. 8 October 2026

   Our check

   All three entries are marked offline. Our plain request fails because the name does not resolve in DNS.

What the pattern suggests, and what it does not: three addresses reported in four seconds looks like one person recording one attack chain, page, document page and the address the page talks to. That is our reading of the times, not something the report says.

How FileFix and ClickFix work

ClickFix and FileFix do not break into Windows. They make you run the attacker's command yourself, so Windows sees an ordinary user action. We did not see the page on fahrzeugvergabe.de; this is how Microsoft, the researcher mr.d0x, Bridewell and Acronis describe the technique.

1. 1

   ClickFix: a fake check or a fake error

   Microsoft's Threat Intelligence team (21 August 2025) describes pages that show a fake CAPTCHA, a fake Cloudflare check or a fake browser crash. The page tells you to press the Windows key and R, then Ctrl and V, then Enter. The page has already put a command on your clipboard, so the Run box starts PowerShell or mshta with the attacker's code.

2. 2

   FileFix: a fake shared file

   The researcher mr.d0x published FileFix on 23 June 2025. The page says a file was shared with you and tells you to copy its path, open File Explorer, press Ctrl and L to select the address bar, paste and press Enter. The copied text is really a PowerShell command followed by a # sign and a harmless looking path, so the box shows only the path.

3. 3

   Why the browser opens File Explorer

   The page uses an ordinary file upload button. When you click it, Windows opens its own file window, and the address bar of that window can run commands. mr.d0x notes that a program started this way loses the Mark of the Web, the label Windows puts on downloaded files to warn you.

4. 4

   What the command does

   In the cases Bridewell and Acronis describe, the pasted command starts PowerShell without a visible window, downloads the next stage and runs it. Acronis (16 September 2025) found a FileFix page posing as a Meta security notice in 16 languages, German among them, that pulled code out of JPG pictures and ended with the StealC password stealer.

5. 5

   What arrives at the end

   Microsoft lists Lumma Stealer, Xworm, AsyncRAT, NetSupport, SectopRAT, Latrodectus, DarkGate and others as payloads of ClickFix campaigns. Bridewell names MintsLoader, StealC and the Interlock remote access tool for FileFix. Which one fahrzeugvergabe.de delivered is not known.

The German University of Muenster warned its own staff about the same trick on 7 May 2026. It lists the key presses to watch for: Windows and R, Windows and X followed by I for the Terminal, Ctrl and V, copying a verification code into a new window, or copying a browser address as a check. It says that real CAPTCHAs never ask for any of this.

What a ClickFix or FileFix loader usually brings

The tag Loader says the first program was a door opener. What came through that door on 3 October is not in the report, so the table shows what the sources found in other campaigns of the same kind.

What can be taken if you ran the command

Because the final program is not known, this list is what the families above are known to take. Each item is named by at least one source; no single report lists all of them.

What this can cost you

Seeing the name costs nothing. Opening the page and closing it costs nothing as far as the sources say. The risks below apply to a Windows PC where someone pasted the text and pressed Enter.

• High

  Email, bank and work accounts

  Stealers take saved passwords and session cookies. A stolen session can open your mailbox without a password and without a two step code.

• High

  Crypto

  Wallet files and browser wallet data are on every stealer list we read. Crypto that has been moved cannot be called back.

• High

  Your employer's network

  A page about vehicle documents reads like a business lure. Interlock, named by Bridewell, is tied to ransomware against companies. If this was a work PC, tell your IT team at once.

• Medium

  Someone using the PC later

  If the loader brought a remote access tool, the attacker can return at any time and watch what you do.

• Low

  Nothing, if you only saw the name

  A name in a block list, a DNS log or a browser warning is not an infection.

What you may notice, and what you may not

The command runs hidden and the stealers work in seconds, so most people notice nothing. These are the traces that are left.

How a person ends up on a page like this

Nobody types fahrzeugvergabe.de by chance. The name and the German tag point to a lure aimed at German speaking people or companies. We do not know how the link was sent; these are the routes the sources name for ClickFix and FileFix pages.

1. 1

   An email with a link to documents

   Microsoft describes phishing emails with links or HTML attachments that lead to a ClickFix page. A message about a vehicle, a tender or a contract with a link to the documents fits that pattern; that part is our reading.

2. 2

   A search result or an advert

   The University of Muenster lists manipulated search results and adverts among the ways in. Microsoft also describes pages that open from free streaming sites.

3. 3

   A hacked legitimate site

   Microsoft and Bridewell describe real websites that were broken into and made to show the fake check. The visitor trusts the site and follows the steps.

4. 4

   A fake notice from a big brand

   Acronis describes a FileFix page that posed as a Meta security notice warning that a Facebook account would be closed, asking the visitor to open a shared PDF through File Explorer.

Check your PC before you delete anything

The one question that matters: did you, or someone using this PC, paste a text into File Explorer, the Run box or the Terminal because a web page asked you to? If no, you are not infected by this site. If yes or not sure, do the checks below. None of them deletes anything.

Stop using the PC for banking, email, work or crypto until you are done. The University of Muenster tells its staff to disconnect the device from the network right away; do that if you can.

1. 1

   Disconnect first

   Turn off Wi-Fi or unplug the network cable. A stealer needs the connection to send what it took, and a remote access tool needs it to be used.

2. 2

   Look at the Run box history

   Microsoft names the registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU. Open Registry Editor (press Start, type regedit) and go there. An entry that starts PowerShell, mshta or cmd with a long text you did not type yourself is the trace of ClickFix. Write it down; do not delete it yet.

3. 3

   Look at the File Explorer address history

   Elastic's FileFix rule watches the TypedPaths key under Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths in your user hive. It normally holds folder paths. A line that starts with powershell or another command, often followed by a # and a document path, is the trace of FileFix.

4. 4

   Open Protection history

   In Windows Security > Virus & threat protection > Protection history, look for Trojan:Win32/ClickFix, Behavior:Win32/ClickFix or anything blocked around 3 October 2026 or the day you visited. Microsoft's ClickFix entry says Defender removes threats it detects, and tells you to update definitions and run a full scan.

5. 5

   Look at Startup apps and Task Scheduler

   Open Settings > Apps > Startup and look for names you did not install. Then press Start, type Task Scheduler and look in Task Scheduler Library for tasks with random names that run PowerShell or a program from a user folder. Loaders often add one of these to come back after a restart.

6. 6

   Look at Installed apps

   In Settings > Apps > Installed apps, look for remote support tools you did not install, such as ScreenConnect or NetSupport. Microsoft lists both among ClickFix payloads.

7. 7

   Check your accounts from another device

   Look at the sign in activity of your email, bank, work and exchange accounts and at crypto balances. This is quicker than any file check, and it is where a stealer hurts.

8. 8

   A scan helps, but it does not clear the PC

   A full scan finds known files. No vendor has published an analysis of this site's loader, and we did not infect a PC, so the order of the plan is our judgement from Microsoft's pages, not a tested result.

If you use a Mac, an iPhone or an Android phone

The tags on every report name PowerShell and an exe file, both Windows only. ClickFix pages for Mac do exist: Microsoft names the Atomic macOS Stealer among ClickFix payloads, and Muenster mentions Terminal variants for macOS and Linux. Nothing in these three reports points to one.