Click Fix Campaigns Expand Malware Delivery With New Loaders and Fake Update Lures
Summary: Researchers at Morphisec, BlueVoyant, and Huntress documented three ClickFix campaigns delivering loaders named BabaDeda Loader, Lorem Ipsum Loader, and Potemkin, with BabaDeda activity observed in April 2026 against education and financial organizations. The chains begin with ClickFix lures that trick users into running attacker-supplied PowerShell commands, then use hidden PowerShell, in-memory shellcode, DLL side-loading, and external payload storage to drop information stealers, RATs, and backdoors including DanaBot, SectopRAT, EtherRAT, and Rhysida ransomware.
Key Takeaway: BlueVoyant tied the Lorem Ipsum shift to compromised WordPress sites to Microsoft's disruption of Fox Tempest's malware-signing service, showing operators rebuilt delivery within months of losing their certificates. In the Potemkin intrusion, the attacker reached the domain controller and spread EtherRAT across more than 11 hosts after configuring Defender exclusions and Cloudflare tunnels for persistent access.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026