What Is the BabaDeda Loader? Analysis of a New ClickFix Malware Campaign 

Morphisec researchers observed active BabaDeda loader campaigns (April 2026) targeting education and financial organizations; the evolved loader uses social-engineered PowerShell execution, modular staging, external payload storage, DLL sideloading, and in-memory execution to deliver information stealers and remote access trojans (DanaBot, SectopRAT). The report emphasizes the framework's stealth and evasion techniques that defeat file- and signature-based detection and recommends prevention-first defenses.