Cybersecurity researchers have flagged multiple
ClickFix campaigns that deliver three malware loaders called BabaDeda Loader, Lorem Ipsum Loader, and Potemkin, per independent reports from Morphisec, BlueVoyant, and Huntress, respectively.
Attacks involving BabaDeda Loader, observed in April 2026, have targeted education and financial organizations.
"Earlier BabaDeda activity was known for concealing malicious payloads inside legitimate looking installer packages," Morphisec researcher Shmuel Uzan said. "This new framework keeps that same code genome but expands it into a far more capable loader built for stealth, evasion, and payload flexibility."
The starting point of the attacks is a ClickFix social engineering attack that deceives users into running attacker-supplied PowerShell commands to deliver the loader, which is then used to drop information stealers and remote access trojans (RATs) by combining well-known techniques like hidden PowerShell, in-memory shellcode, DLL side-loading, and external payload storage.
The activity has been attributed to
BabaDeda, a crypter service that was first documented by Morphisec in November 2021 in connection with a campaign targeting the cryptocurrency and Web3 sectors to distribute information stealers, RATs, and LockBit ransomware.
The loader is designed to profile the host, avoid running on Russian or Belarusian systems, and perform security product-related checks before retrieving the main payload and injecting it into a trusted Windows process such as "svchost.exe."
One of the malware families delivered via BabaDeda Loader is a .NET backdoor and information stealer that can harvest sensitive data and establish an encrypted channel to a command-and-control (C2) server. The malware supports a wide range of functions, including -
- Collecting detailed system information
- Discovering installed browser profiles
- Extracting browser artifacts such as cookies, browsing history, saved credentials, preferences, and local-state encryption keys
- Traversing directories and selecting files based on configurable rules
- Reading and exfiltrating file contents
- Capturing screenshots and displaying information
- Executing shell commands or external processes and collecting output
- Transferring data back to the C2 server
- Using native Windows APIs for process interaction, memory operations, DPAPI access, Restart Manager behavior, and advanced file access
A second attack chain drops a ZIP archive that employs DLL side-loading to launch DanaBot and SectopRAT (aka ArechClient). What's notable about these attacks is the use of a staged loader component dubbed Storage Crypter that reads the payload material from external storage-like files such as "List.Control.dat."
"The visible application package appears legitimate, while malicious payloads remain hidden inside externally stored containers and are decoded only moments before execution," Morphisec said. "This design minimizes forensic visibility, complicates automated analysis, and reduces opportunities for traditional security tools to identify malicious activity before execution occurs."
The findings represent an evolution of the modern loader frameworks, which have become increasingly modular and separate delivery, storage, execution, and payload deployment into distinct components rather than relying on a single monolithic entity.
ClickFix Chain Drops Lorem Ipsum Loader
The Click Fix technique has also been observed in an active campaign that uses at least five compromised WordPress sites as a starting point to deliver a nascent loader, and backdoor codenamed Lorem Ipsum Loader. The hacked websites span multiple sectors, including architecture, legal services, and construction technology.
The attacks mark a departure from
prior opportunistic campaigns that employed trojanized Microsoft Teams installers through fake download portals promoted via SEO poisoning and malvertising. The loader is believed to be active in the wild since February 2026.
"The pivot to ClickFix lures hosted on compromised WordPress (WP) sites significantly broadens the potential victim pool and demonstrates the operators' willingness to rapidly adapt their initial access techniques," BlueVoyant researchers Thomas Elkins and Joshua Green said.
The change in delivery mechanism has been attributed to Microsoft's recent disruption of
Fox Tempest (aka Forging Marauder), a threat actor that advertised a malware-signing-as-a-service (MSaaS) operation to help deliver malware without raising any red flags using fraudulently signed Microsoft Trusted Signing certificates.
"The loss of certificate supply rendered the previously signed-installer delivery model unviable, forcing the operators to adopt a delivery mechanism that eliminates code signing entirely," the researchers added.
The threat activity cluster is the latest instance of how bad actors can easily bounce back and adapt to alternative delivery models despite continued efforts by defenders and law enforcement to dismantle their operations.
The Lorem Ipsum ecosystem has been attributed with high confidence to a financially motivated threat actor known as
Vanilla Tempest (aka Rapid Brigantine, Vice Society, and Vice Spider) that's known for deploying ransomware families like Rhysida, BlackCat, Zeppelin, and Quantum Locker.
Attack sequences distributing Lorem Ipsum Loader make use of ClickFix-style Edge web browser security update lures to run a malicious command that downloads a ZIP file and an outdated version of Node.js released in 2017 (version 7.10.1) to execute JavaScript-based payloads present within the archive while minimizing chances of detection.
The JavaScript payload functions as a dropper for deploying and executing additional malware components on the infected system, including a batch script that sets up persistence by launching a DLL side-loading chain to execute a malicious DLL ("mscoree.dll" or "msvcp140.dll"), which, in turn, decodes the embedded Lorem Ipsum Loader payload.
"The Lorem Ipsum Loader is designed to retrieve the next-stage Lorem Ipsum Backdoor from C2 infrastructure obtained from attacker-controlled profiles hosted on social networking platforms," BlueVoyant said, adding the backdoor contains functionality to run next-stage payloads received from the C2 server.
"The Lorem Ipsum chain culminates in handoff to Rapid Brigantine's established post-exploitation tooling and ultimately to their documented ransomware deployments, primarily Rhysida."
Potemkin, RMMProject, and EtherRAT Delivered via ClickFix
The third campaign to rely on ClickFix is a sophisticated attack chain that installs an MSI package, which then drops a previously undocumented loader codenamed Potemkin via an HTML Application (HTA) payload. The loader serves as a conduit for
EtherRAT and RMMProject, a Lua-scriptable DLL with modules to enable remote screen control and browser credential theft by getting around Chromium's App-Bound Encryption ( ABE) protections.
RMMProject also implements a task dispatcher mechanism to run a file or process, take screenshots, siphon browser autofill data, execute arbitrary Lua scripts, terminate browser processes, and download and run an additional module from a URL at runtime.
Potemkin loader is a "custom x64 loader that uses a domain generation algorithm to find its C2 and reflectively loads follow-on modules in memory," Huntress researchers Anna Pham and Zach Rogers said. The activity was detected by the security vendor last month.
The loader supports various functionally distinct components to handle the overall lifecycle, DGA-driven C2 discovery using a built-in 1,000-word dictionary, victim identification by means of a unique UUID value written to "%LOCALAPPDATA%\hyper-v.ver," task polling, DLL retrieval and execution, and a custom byte cipher to protect the C2 communication and the DGA dictionary.
With the access established, the unknown threat actor is said to have engaged in hands-on keyboard activity to configure Microsoft Defender exclusions, deploy Chisel reverse SOCKS tunnels, conduct additional reconnaissance, set up a Cloudflare tunnel for persistent access, and spread laterally via WMIExec and SMBExec to reach the domain controller and propagate EtherRAT across over 11 hosts.
ClickFix Remains an Enduring Technique
The discoveries come as ClickFix
continues to be an effective method to target Windows and macOS users with fraudulent bot verification screens to deliver malicious payloads like Phexia Stealer, a macOS infostealer, and HellsUchecker, a backdoor delivered via EtherHiding that's capable of executing files retrieved from C2 and reporting the results back.
ClickFix campaigns have also
capitalized on the growing interest surrounding artificial intelligence (AI) tools to distribute fake MSI installers for Claude to run PowerShell payloads.
"ClickFix remains effective for a simple reason: it exploits human nature. People naturally follow directions when presented with a clear, authoritative-looking instruction ('press Win+R, paste this, hit Enter')," Huntress researchers said. "The social engineering doesn't need to be sophisticated; it just needs to look like a legitimate troubleshooting step, and more often than not, that's enough."
The risk posed by pasting commands into the Terminal app from websites (or chat agents, or messaging or email apps) has prompted Apple to
introduce a new security pop-up in macOS Tahoe 26.4 that warns Mac users attempting to do so.
"Scammers use these channels to instruct people to paste malicious commands into Terminal to harm your Mac or compromise your privacy," Apple
notes in a support document published this week. "This alert helps make sure that you aren't tricked into running a command that you didn't expect."
<small>Source: The Hacker News</small>
