ClickFix Campaigns Expand Malware Delivery: BabaDeda, Lorem Ipsum & Potemkin Loaders

Multiple independent ClickFix social engineering campaigns observed between April and June 2026 are delivering three distinct malware loaders BabaDeda Loader, Lorem Ipsum Loader, and Potemkin that fetch information stealers, remote access trojans, and ransomware-linked tooling onto Windows hosts. Victims are lured into pasting attacker supplied commands into the Run dialog or terminal, after which the chains combine hidden PowerShell, LOLBIN proxy execution, DLL side loading, and in memory reflective loading to evade detection. The Lorem Ipsum chain is attributed with high confidence to the financially motivated group Rapid Brigantine and culminates in Rhysida ransomware.