ClickFix Campaigns Expand Malware Delivery With New Loaders and Fake Update Lures

Researchers have observed multiple ClickFix-based campaigns delivering three loaders — BabaDeda Loader, Lorem Ipsum Loader, and Potemkin — used to deploy information-stealers, RATs (including EtherRAT, DanaBot, SectopRAT), and to facilitate ransomware operations. The report outlines delivery methods (malicious PowerShell commands, compromised WordPress lures, ZIP archives with DLL side-loading, MSI/HTA), advanced loader features (in-memory reflective loading, staged storage crypter, DGA-driven C2), targeted sectors (education, finance, and others), and post-exploitation activities including persistence, Defender exclusions, tunneling, and lateral movement to domain controllers.