DeepLoad Malware Explained: ClickFix Delivery and Password Stealing

This report analyzes DeepLoad, a fileless loader observed in March 2026 that leverages ClickFix social engineering to execute an obfuscated PowerShell payload in memory, uses APC-based injection into trusted Windows binaries (e.g., LockAppHost.exe) to evade detection, and immediately performs credential theft via a separate stealer (filemanager.exe) and a malicious browser extension; it also propagates via USB by dropping numerous .lnk shortcuts to re-trigger infection and includes Picus simulation IDs for validating defenses.