Loading story…
ReliaQuest researchers reported that a credential-stealing malware campaign dubbed DeepLoad has been compromising enterprise IT environments through ClickFix/QuickFix-style social engineering. Attackers used fake browser prompts and error pages to trick users into running a malicious command, which launched a loader engineered to bypass multiple security tools. Researchers said the malware used heavily padded code and execution tied to a Windows lock-screen process, indicating AI-assisted obfuscation at multiple stages to reduce the effectiveness of static, file-based detection.
Once installed, DeepLoad enabled real-time keylogging, stole credentials, spread to connected USB drives, and maintained hidden persistence that allowed the malware to re-execute days after apparent cleanup. The campaign's ability to survive standard remediation has raised concern that AI-generated variation is making malware more adaptable and harder to detect. Researchers urged defenders to emphasize behavioral and runtime detection over traditional static analysis to identify similar threats earlier.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
In its reporting on the campaign, ReliaQuest warned that AI-generated variation is reducing the effectiveness of static, file-based detection. The researchers advised defenders to prioritize behavioral and runtime detection methods to identify DeepLoad and similar threats earlier.
ReliaQuest researchers reported that DeepLoad used suspected AI-assisted obfuscation at multiple stages to evade security tools, including heavily padded code and execution behind a Windows lock screen process. They also found the malware could keylog in real time, spread to connected USB drives, and re-execute days after cleanup through a hidden persistence mechanism.
A credential-stealing malware campaign dubbed DeepLoad was observed infecting enterprise business IT environments. Attackers used QuickFix/ClickFix-style social engineering, including fake browser prompts and error pages, to trick users into launching the malware loader.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported two newly documented Windows malware loaders, **Kiss Loader** and **DeepLoad**, in emerging campaigns that rely on stealthy execution and social engineering to deliver follow-on malware. G DATA said Kiss Loader was delivered through phishing emails using Internet Shortcut (`.url`) files disguised as PDFs, which retrieved payloads through a TryCloudflare tunnel and an exposed WebDAV repository. The loader established persistence, showed a decoy PDF, downloaded additional components, and deployed malware including **VenomRAT** and a `.NET Reactor`-protected sample identified as **Kryptik**. DeepLoad was distributed through the **ClickFix** technique, tricking victims into pasting malicious PowerShell into the Windows Run dialog before launching `mshta.exe` and obfuscated PowerShell to execute the infection chain. Researchers said the malware used **APC injection**, AI-assisted obfuscation, randomized `Add-Type` DLL compilation, PowerShell history suppression, abuse of legitimate processes such as `LockAppHost.exe`, and **WMI event subscriptions** for persistence and reinfection. Its objectives included browser credential theft, deployment of a malicious browser extension to capture logins, and propagation through removable media with deceptive `.lnk` filenames, while Kiss Loader similarly used **Early Bird APC injection** into `explorer.exe` to evade detection and run payloads in memory.
Jun 29, 2026
Security researchers reported multiple active campaigns using **ClickFix** social engineering—fake error dialogs or verification prompts that trick users into manually running attacker-supplied commands—to bypass browser and download protections and establish an initial foothold. In one enterprise case investigated by **CERT Polska (cert.pl)**, victims were lured via compromised websites showing a fake CAPTCHA/“fix” prompt that instructed them to paste and run a **PowerShell** command via `Win+R`; the script then downloaded a dropper and enabled rapid follow-on activity that can scale to **enterprise-wide compromise**, including deployment of secondary malware such as **Latrodectus** and **Supper** for data theft, lateral movement, and potential ransomware staging. A separate ClickFix operation targeted **macOS developers** by cloning the *Homebrew* site on typosquatted infrastructure; the “install” command was subtly altered to fetch content from `raw.homabrews.org` instead of `raw.githubusercontent.com`, leading to **Cuckoo Stealer** deployment and credential harvesting via repeated password prompts using macOS Directory Services, with related domains tied to shared hosting at **`5.255.123.244`**. ClickFix was also observed as the initial execution mechanism for the resurfaced **Matanbuchus 3.0** MaaS loader, which uses deceptive copy/paste prompts and **silent MSI** execution (via `msiexec`) to deliver a new payload, **AstarionRAT**, enabling capabilities including credential theft and **SOCKS5** proxying; operators were reported to move laterally quickly (including toward domain controllers), consistent with ransomware or data-exfiltration objectives.
Jul 2, 2026
A wave of **social-engineering-driven malware delivery** is abusing “verification” and “fix” workflows to trick users into running attacker-supplied commands that install information stealers. LevelBlue reported a campaign using **fake Cloudflare-style CAPTCHA pages** on compromised websites to convince Windows users to manually execute malicious **PowerShell** commands, resulting in **StealC** deployment; StealC is described as exfiltrating browser credentials, crypto wallet data, Steam and Outlook credentials, system information, and screenshots over **RC4-encrypted HTTP** to a C2 server. Intego also identified an evolved **ClickFix** technique on macOS (“**Matryoshka**”) that leverages **typosquatting** to redirect users to pages instructing them to paste “fix” commands into Terminal; the loader then retrieves an AppleScript payload to steal browser credentials and target wallet apps (e.g., *Trezor Suite*, *Ledger Live*), including repeated fake password prompts as a fallback. Separately, other credential-theft campaigns are also leaning heavily on lures that exploit user trust and routine workflows. Morphisec described **Noodlophile** evolving from fake AI video platform ads to **fake job postings** and phishing “assessments,” delivering multi-stage stealers/RATs via techniques including **DLL sideloading**, while continuing to use **Telegram bots** for exfiltration/C2 and adding file-bloating content intended to disrupt automated analysis. These developments reinforce that user-in-the-loop execution (copy/paste commands, “verification” steps, and recruitment-themed forms) remains a high-yield initial access vector for stealers across both Windows and macOS environments.
Jun 29, 2026