DeepLoad Credential-Stealing Malware Used AI-Assisted Obfuscation to Evade Detection

ReliaQuest researchers reported that a credential-stealing malware campaign dubbed DeepLoad has been compromising enterprise IT environments through ClickFix/QuickFix-style social engineering. Attackers used fake browser prompts and error pages to trick users into running a malicious command, which launched a loader engineered to bypass multiple security tools. Researchers said the malware used heavily padded code and execution tied to a Windows lock-screen process, indicating AI-assisted obfuscation at multiple stages to reduce the effectiveness of static, file-based detection.

Once installed, DeepLoad enabled real-time keylogging, stole credentials, spread to connected USB drives, and maintained hidden persistence that allowed the malware to re-execute days after apparent cleanup. The campaign's ability to survive standard remediation has raised concern that AI-generated variation is making malware more adaptable and harder to detect. Researchers urged defenders to emphasize behavioral and runtime detection over traditional static analysis to identify similar threats earlier.