DeepLoad Malware Uses ClickFix and WMI Persistence to Steal Browser Credentials

A recent campaign leverages a ClickFix social-engineering lure and malicious shortcuts to deliver two loaders: DeepLoad — a sophisticated PowerShell-based loader that uses AI-assisted obfuscation, in-memory APC injection, runtime C# DLL compilation, WMI persistence, USB spread, and a malicious browser extension to steal credentials — and Kiss Loader, distributed via URL shortcuts that fetch a Python loader and deploy Venom RAT via APC injection. Both aim to evade detection, maintain persistence, and exfiltrate credentials across infected hosts.