Lorem Ipsum

Campaign infrastructure is consistently registered through NameCheap with Withheld-for-Privacy domain privacy service out of Iceland and weaponized within hours to days of registration

In October 2025, MSTIC publicly attributed and disrupted a Rapid Brigantine campaign distributing fake MSTeamsSetup.exe files hosted on Teams-themed malicious domains ... driven by SEO poisoning and malvertising.

For the new ClickFix delivery model, Lorem Ipsum's operator is currently using at least five legitimate but compromised WordPress websites to host its ClickFix lures.

The pivot to ClickFix lures hosted on compromised WordPress (WP) sites significantly broadens the potential victim pool.

MITRE ATT&CK Techniques ... T1588.001 (Obtain Capabilities: Malware)

MITRE ATT&CK Techniques ... T1588.005 (Obtain Capabilities: Exploits)

In the March 2026 iteration of the campaign, the operators relied on plainraw[.]com ... to serve gzip-compressed, hex-encoded PowerShell payloads under disposable /raw/<hex> URL paths embedded in the trojanized MSI installers.

MITRE ATT&CK Techniques ... T1608.001 (Stage Capabilities: Upload Malware)

MITRE ATT&CK Techniques ... T1608.002 (Stage Capabilities: Upload Tool)

MITRE ATT&CK Techniques ... T1608.004 (Drive-by Target)

The previous campaign relied on resource-intensive infrastructure — SEO-poisoned and malvertised download portals, short-validity Microsoft Trusted Signing certificates, and continuously rotated NameCheap-registered MSI delivery domains.

MITRE ATT&CK Techniques T1102.001 (Dead Drop Resolver) T1189 (Drive-by Compromise) T1204.004 (Malicious Copy and Paste)

MITRE ATT&CK Techniques ... T1195 (Supply Chain Compromise)

An injected iframe on the website displays a fake browser update notification about the user's browser being out of date.

The PowerShell script decrypts a hardcoded Base64-encoded payload embedded within itself using AES encryption.

...downloads a ZIP file and an outdated version of Node.js released in 2017 (version 7.10.1) to execute JavaScript-based payloads present within the archive...

The MSI file contains a custom action that executes the PowerShell loader component silently by incorporating the -WindowStyle Hidden flag

The pivot to ClickFix in late May 2026 eliminates the code-signing requirement entirely, substituting the legitimacy of a validly signed installer with a different form of legitimacy: a user voluntarily executing the malicious command in their own terminal.

the pop-op instructs the user to paste a provided PowerShell command, disguised as a Microsoft Edge security intelligence update, into their Windows Terminal.

The website displays an iframe, presenting the user with a fake pop up indicating that their browser is out of date. The iframe includes instructions on how to remediate, simply by opening up windows terminal ( wt.exe ) and pasting a command into the terminal.

...including a batch script that sets up persistence by launching a DLL side-loading chain to execute a malicious DLL...

That script first establishes persistence by duplicating the original PowerShell command line and writing it to a Run key in the Windows registry

...including a batch script that sets up persistence by launching a DLL side-loading chain to execute a malicious DLL...

That script first establishes persistence by duplicating the original PowerShell command line and writing it to a Run key in the Windows registry

the Lorem Ipsum loader begins by resolving various Windows libraries using the API LoadLibraryA ... then resolves specific corresponding APIs using GetProcAddress

The Lorem Ipsum campaign initially relied on SEO poisoning to lure users into downloading Trojanized Microsoft Teams installers signed with valid Microsoft Trusted Signing certificates.

The MSI file contains a custom action that executes the PowerShell loader component silently by incorporating the -WindowStyle Hidden flag

newer versions employ a more sophisticated approach, rebuilding the payload through a substitution cipher-based decoding algorithm.

Following API resolution, the shellcode creates a mutex via CreateMutexA to prevent concurrent execution.

The MSI file contains a custom action that executes the PowerShell loader component silently by incorporating the -WindowStyle Hidden flag, concealing it from the end user

The second PowerShell code is responsible for decoding another Base64-encoded payload embedded within itself, decompress it using gzip, and reflectively loads it directly into memory for execution, ensuring it is never written to disk.

Next, the backdoor gathers information about the impacted host, storing the information in JSON.

the platform itself is entirely legitimate and has not been compromised; it is being abused in much the same way that threat actors have historically abused Pastebin, GitHub Gists, Telegram channels, and Google Docs

the loader abuses letsdiskuss[.]com, a legitimate India-based question-and-answer/blogging platform, as a dead-drop resolver for C2 infrastructure across at least four attacker-controlled profiles.

Each infection beacons to three redundant Cloudflare-fronted C2 domains using the same per-victim UUID, complicating takedown and rendering IP-based blocking ineffective.

If the C2 server is active, it responds with a JFIF file containing additional data appended beyond the image boundary including a new UUID.

the loader attempts to establish communication by transmitting its embedded JFIF image to the C2 server using a Content-Type: image/jpeg header rather than a conventional HTTPS request.