New DeepLoad Malware Uses ClickFix and AI-Generated Evasion to Breach Enterprise Networks

DeepLoad is a sophisticated enterprise-targeting malware campaign that tricks users into pasting a PowerShell command to install a persistent loader which uses mshta.exe to fetch obfuscated payloads, compiles an in-memory C# injector, performs APC-based process injection into LockAppHost.exe, plants hidden WMI event subscriptions for reinfection, drops a credential stealer (filemanager.exe), installs a malicious browser extension to capture passwords/session tokens, and writes disguised installer files to USB drives; defenders are advised to audit and clear WMI subscriptions, rotate credentials, remove unapproved extensions, audit USB media, enable PowerShell Script Block Logging, and shift to behavioral/EDR detection.