Lorem Ipsum Malware Shifted to ClickFix After Microsoft Certificate Crackdown

BlueVoyant and other researchers reported that the Lorem Ipsum malware operation abandoned Trojanized Microsoft Teams installers signed with fraudulent Microsoft Trusted Signing certificates and moved to ClickFix lures hosted on compromised WordPress sites. The change followed Microsoft’s disruption of the Fox Tempest malware-signing-as-a-service ecosystem and revocation of more than 1,000 fraudulently obtained certificates, which undercut the group’s earlier delivery method. BlueVoyant assessed with high confidence that the activity is tied to Rapid Brigantine—also tracked as Vanilla Tempest, DEV-0832, and Vice Society—a financially motivated actor linked to ransomware and data extortion.

The updated infection chain uses fake browser updates or CAPTCHA-style prompts to socially engineer victims into running malicious commands, expanding targeting beyond users searching for fake Teams downloads. Researchers said the malware relies on a multistage loader, DLL sideloading, encrypted payloads, and dead-drop command-and-control through LetsDiskuss[.]com, while parallel ClickFix campaigns have also delivered loaders such as BabaDeda, Potemkin, and GULoader using in-memory execution and remote DLL loading via rundll32.exe. The reporting underscores ClickFix as a durable initial-access technique on compromised websites that can lead to stealers, RATs, remote management tools, and hands-on-keyboard post-compromise activity.