ClickFix Campaign Delivers Stealthy “DeepLoad” Malware to Hijack Browser Sessions

A newly uncovered cyber campaign is drawing attention across the security community for its effective blend of social engineering, fileless execution, and stealth persistence. Researchers at ReliaQuest have identified a previously undocumented malware loader, dubbed DeepLoad, that is being distributed via the increasingly popular “ClickFix” tactic—an approach that relies on user interaction rather than software exploits to gain initial access.

The attack begins with a deceptive prompt that convinces users to copy and paste a malicious command into the Windows Run dialog, often under the pretense of fixing a system issue or completing a verification step. Once executed, the command launches PowerShell, which in turn leverages the legitimate Windows utility mshta.exe to retrieve and run an obfuscated payload. This technique allows attackers to bypass many traditional security controls by relying entirely on trusted system tools and user-initiated actions.

At the core of the campaign is DeepLoad’s sophisticated loader, which conceals its true purpose beneath layers of meaningless code and randomized variables. According to researchers, this obfuscation is likely generated with the assistance of artificial intelligence, enabling attackers to rapidly produce unique variants that are difficult for static detection engines to identify. Rather than dropping obvious malicious files to disk, the malware dynamically compiles components in memory using PowerShell’s Add-Type feature, creating temporary DLLs with randomized names that evade file-based detection.

Once active, DeepLoad takes deliberate steps to blend into the operating system. It disguises its activity within legitimate processes such as LockAppHost.exe, disables PowerShell command history to remove forensic evidence, and interacts directly with native Windows APIs instead of relying on monitored scripting functions. To further obscure its presence, the malware employs asynchronous procedure call (APC) injection, launching a trusted process in a suspended state, injecting malicious code into its memory, and then resuming execution—ensuring that no decoded payload is ever written to disk.

The ultimate objective of the campaign is credential theft, but the methods employed go beyond traditional password dumping. DeepLoad extracts stored browser credentials while also deploying a malicious browser extension capable of intercepting login data in real time. This allows attackers to capture active session information, significantly increasing the likelihood of successful account compromise even in environments with stronger authentication controls.

Persistence is another area where DeepLoad distinguishes itself. The malware leverages Windows Management Instrumentation (WMI) to establish covert event subscriptions that can silently re-execute the attack chain long after the initial infection. In observed cases, systems that appeared to be remediated were reinfected days later without any additional user interaction, highlighting the resilience of this approach and its ability to evade conventional detection mechanisms.

Adding to the threat, DeepLoad includes propagation capabilities that enable it to spread via removable media. When a USB device is connected, the malware copies itself using deceptive file names such as “ChromeSetup.lnk” or “Firefox Installer.lnk,” increasing the likelihood that unsuspecting users will execute the malicious payload on other systems.

The discovery of DeepLoad comes amid a broader wave of increasingly sophisticated malware loaders. Researchers have also pointed to emerging threats like Kiss Loader, which uses layered scripting techniques and cloud-hosted payload delivery to deploy remote access trojans. Together, these campaigns reflect a growing trend toward modular, multi-stage malware that relies heavily on legitimate tools, obfuscation, and user interaction to evade detection.

Security experts warn that DeepLoad exemplifies a shift in attacker strategy. Rather than exploiting software vulnerabilities, threat actors are focusing on manipulating users, blending malicious activity with normal system behavior, and maintaining long-term access through stealthy persistence mechanisms. As a result, traditional defenses that rely on signatures or known indicators are becoming less effective, underscoring the need for behavioral monitoring and deeper visibility into system activity.

In this evolving threat landscape, campaigns like DeepLoad demonstrate that the most effective attacks may no longer depend on sophisticated exploits, but instead on subtle deception and the abuse of trusted technologies already present within the operating system.

What Organizations Should Do Next

Defending against campaigns like DeepLoad requires shifting focus from traditional signatures to behavioral visibility and user awareness. Security teams should prioritize the following actions:

• Restrict PowerShell abuse
  • Enable script block logging and transcription
  • Constrain or disable PowerShell where not required
• Monitor for LOLBin activity
  • Alert on suspicious use of mshta.exe, powershell.exe, and similar binaries
  • Look for unusual parent-child process relationships
• Audit and detect WMI persistence
  • Regularly review WMI event subscriptions
  • Alert on newly created or modified WMI consumers and filters
• Harden browser security
  • Restrict unauthorized browser extensions
  • Monitor for unexpected extension installations across endpoints
• Improve endpoint visibility
  • Ensure EDR solutions track in-memory execution and injection techniques
  • Watch for signs of APC injection and reflective DLL loading
• Control removable media risks
  • Disable or limit USB usage where possible
  • Scan and block suspicious shortcut (.lnk) files
• Invest in user awareness
  • Train users to avoid running commands from untrusted prompts
  • Reinforce that legitimate fixes never require copying commands into Run dialogs

As attackers continue to refine techniques like ClickFix and fileless execution, the line between legitimate system activity and malicious behavior is becoming increasingly blurred. Organizations that rely solely on prevention will struggle—those that invest in visibility, detection, and user education will be far better positioned to respond.