Malware Activity
ClickFix Campaigns Evolve to Deliver New Malware Loaders and Enable Ransomware Intrusions
Cybersecurity researchers have identified multiple active ClickFix campaigns delivering newly documented malware loaders (BabaDeda Loader, Lorem Ipsum Loader, and Potemkin) highlighting the continued effectiveness and evolution of ClickFix social engineering attacks. The campaigns rely on deceptive prompts that trick users into executing malicious PowerShell commands, ultimately deploying information stealers, RATs, and ransomware-related tooling. BabaDeda Loader, linked to the long-running BabaDeda crypter service, targets education and financial organizations using stealth techniques such as in-memory shellcode execution, DLL side-loading, and externally stored payloads to deliver stealers and backdoors capable of extensive data theft and remote control. Separately, compromised WordPress sites are being used to distribute Lorem Ipsum Loader, which has been attributed with
