ClickFix Campaigns Expand Malware Delivery: BabaDeda, Lorem Ipsum & Potemkin Loaders

ClickFixLoaderInformation StealerDLL Side-Loading

Multiple independent ClickFix social engineering campaigns observed between April and June 2026 are delivering three distinct malware loaders BabaDeda Loader, Lorem Ipsum Loader, and Potemkin that fetch information stealers, remote access trojans, and ransomware-linked tooling onto Windows hosts. Victims are lured into pasting attacker supplied commands into the Run dialog or terminal, after which the chains combine hidden PowerShell, LOLBIN proxy execution, DLL side loading, and in memory reflective loading to evade detection. The Lorem Ipsum chain is attributed with high confidence to the financially motivated group Rapid Brigantine and culminates in Rhysida ransomware.

Indicators of Compromise

Domains (15)

autoupdaters.comfair-bath-fond.xyzrule-bead-dust.xyzcl.distritovagas.comdigitalpoint.comuglyshop-mare.xyzsearchdocumentsfree.comautoupdatet.comopenanyworddocument.comanus-staylard.xyzautoupdatethis.compestrear-lamp.xyzsonra.eutialyson.comkittyfreespace.comletsdiskuss.com

Hashes (4)

97bc78ad3fd6549f3a7f9cb31be1ff25d50bac97c42fc6dfff44e47424c5add1dff20059f161090c76f9f45ac2269f2965bdc96023c78c1072f8d1aa66b06919cd4e5e2c65b1660470d3446539ee68adf5faeece3eaeb46583623be9911ee1453b7ae925e2d64522b4f69b56285b05aeca8c5aab5ab46a9c02c4fafb69d881ce

IPv4 (1)

51.222.96.58

APT Groups

VICE SPIDER

Notes

<div style="line-height: 1.38; margin-top: 0pt; margin-bottom: 4pt;">CONCLUSION ClickFix continues to be one of the most effective initial-access techniques because it weaponizes user trust rather than a software vulnerability, remaining viable even against fully patched systems. The convergence of three independent loader families — BabaDeda, Lorem Ipsum, and Potemkin — on the same lure within a single quarter shows how rapidly criminal operators adopt it, and how modern loaders now separate delivery, storage, execution, and payload into distinct, individually-benign components to defeat signature-based defense. Organizations should prioritize behavioral detection of the execution chain over static indicators, harden script interpreters and autostart locations, and treat any confirmed loader indicator as an active, fast-moving incident. SOCRadar customers can operationalize this intelligence across the platform. Use <a href="https://socradar.io/products/ioc-radar/" style="color: rgb(59, 130, 246);">IOC Radar</a> to search and enrich the indicators above, the <a href="https://socradar.io/products/cyber-threat-intelligence/" style="color: rgb(59, 130, 246);">Cyber Threat Intelligence</a><a href="https://socradar.io/products/cyber-threat-intelligence/" style="color: rgb(59, 130, 246);"> </a>module to track Rapid Brigantine and ClickFix loader activity, <a href="https://socradar.io/products/attack-surface-management/" style="color: rgb(59, 130, 246);">Attack Surface Management</a> to identify exposed and compromisable web assets (e.g. vulnerable WordPress installations) before they are abused as delivery infrastructure, and <a href="https://socradar.io/products/dark-web-monitoring/" style="color: rgb(59, 130, 246);">Dark Web Monitoring</a> to detect leaked credentials and ransomware-related exposure tied to these campaigns.</div><div> </div>

Mitigation

<div style="line-height: 1.38; margin-top: 0pt; margin-bottom: 5pt;">Mitigation MITRE ATT&CK mitigations mapped to the techniques observed across the BabaDeda, Lorem Ipsum, and Potemkin ClickFix chains.</div><div align="left" style="margin-left: 0pt;"><table style="border-width: medium; border-style: none; border-color: currentcolor; border-image: initial; border-collapse: collapse;"><colgroup><col><col><col></colgroup><thead><tr style="height: 0pt;"><th style="border-width: 0.5pt; border-style: solid; border-color: rgb(191, 191, 191); vertical-align: top; background-color: rgb(31, 78, 121); padding: 3pt 5.5pt; overflow: hidden; overflow-wrap: break-word;">Technique</th><th style="border-width: 0.5pt; border-style: solid; border-color: rgb(191, 191, 191); vertical-align: top; background-color: rgb(31, 78, 121); padding: 3pt 5.5pt; overflow: hidden; overflow-wrap: break-word;">Name</th><th style="border-width: 0.5pt; border-style: solid; border-color: rgb(191, 191, 191); vertical-align: top; background-color: rgb(31, 78, 121); padding: 3pt 5.5pt; overflow: hidden; overflow-wrap: break-word;">Mitigation</th></tr></thead><tbody><tr style="height: 0pt;"><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(191, 191, 191); vertical-align: top; padding: 3pt 5.5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/techniques/T1189/" style="color: rgb(59, 130, 246);">T1189</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(191, 191, 191); vertical-align: top; padding: 3pt 5.5pt; overflow: hidden; overflow-wrap: break-word;">Drive-by Compromise</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(191, 191, 191); vertical-align: top; padding: 3pt 5.5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1048/" style="color: rgb(59, 130, 246);">M1048</a> / <a href="https://attack.mitre.org/mitigations/M1050/" style="color: rgb(59, 130, 246);">M1050</a> / <a href="https://attack.mitre.org/mitigations/M1021/" style="color: rgb(59, 130, 246);">M1021</a> / <a href="https://attack.mitre.org/mitigations/M1051/" style="color: rgb(59, 130, 246);">M1051</a></td></tr><tr style="height: 0pt;"><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(191, 191, 191); vertical-align: top; background-color: rgb(242, 246, 251); padding: 3pt 5.5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/techniques/T1204/004/" style="color: rgb(59, 130, 246);">T1204.004</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(191, 191, 191); vertical-align: top; background-color: rgb(242, 246, 251); padding: 3pt 5.5pt; overflow: hidden; overflow-wrap: break-word;">User Execution: Malicious Copy and Paste</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(191, 191, 191); vertical-align: top; background-color: rgb(242, 246, 251); padding: 3pt 5.5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1038/" style="color: rgb(59, 130, 246);">M1038</a> / <a href="https://attack.mitre.org/mitigations/M1031/" style="color: rgb(59, 130, 246);">M1031</a> / <a href="https://attack.mitre.org/mitigations/M1021/" style="color: rgb(59, 130, 246);">M1021</a></td></tr><tr style="height: 0pt;"><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(191, 191, 191); vertical-align: top; padding: 3pt 5.5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/techniques/T1059/001/" style="color: rgb(59, 130, 246);">T1059.001</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(191, 191, 191); vertical-align: top; padding: 3pt 5.5pt; overflow: hidden; overflow-wrap: break-word;">Command and Scripting Interpreter: PowerShell</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(191, 191, 191); vertical-align: top; padding: 3pt 5.5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1049/" style="color: rgb(59, 130, 246);">M1049</a> / <a href="https://attack.mitre.org/mitigations/M1045/" style="color: rgb(59, 130, 246);">M1045</a> / <a href="https://attack.mitre.org/mitigations/M1042/" style="color: rgb(59, 130, 246);">M1042</a> / <a href="https://attack.mitre.org/mitigations/M1026/" style="color: rgb(59, 130, 246);">M1026</a> / <a href="https://attack.mitre.org/mitigations/M1040/" style="color: rgb(59, 130, 246);">M1040</a></td></tr><tr style="height: 0pt;"><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(191, 191, 191); vertical-align: top; background-color: rgb(242, 246, 251); padding: 3pt 5.5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/techniques/T1574/002/" style="color: rgb(59, 130, 246);">T1574.002</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(191, 191, 191); vertical-align: top; background-color: rgb(242, 246, 251); padding: 3pt 5.5pt; overflow: hidden; overflow-wrap: break-word;">Hijack Execution Flow: DLL Side-Loading</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(191, 191, 191); vertical-align: top; background-color: rgb(242, 246, 251); padding: 3pt 5.5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1047/" style="color: rgb(59, 130, 246);">M1047</a> / <a href="https://attack.mitre.org/mitigations/M1045/" style="color: rgb(59, 130, 246);">M1045</a> / <a href="https://attack.mitre.org/mitigations/M1052/" style="color: rgb(59, 130, 246);">M1052</a> / <a href="https://attack.mitre.org/mitigations/M1051/" style="color: rgb(59, 130, 246);">M1051</a></td></tr><tr style="height: 0pt;"><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(191, 191, 191); vertical-align: top; padding: 3pt 5.5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/techniques/T1547/001/" style="color: rgb(59, 130, 246);">T1547.001</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(191, 191, 191); vertical-align: top; padding: 3pt 5.5pt; overflow: hidden; overflow-wrap: break-word;">Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(191, 191, 191); vertical-align: top; padding: 3pt 5.5pt; overflow: hidden; overflow-wrap: break-word;">--</td></tr><tr style="height: 0pt;"><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(191, 191, 191); vertical-align: top; background-color: rgb(242, 246, 251); padding: 3pt 5.5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/techniques/T1555/003/" style="color: rgb(59, 130, 246);">T1555.003</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(191, 191, 191); vertical-align: top; background-color: rgb(242, 246, 251); padding: 3pt 5.5pt; overflow: hidden; overflow-wrap: break-word;">Credentials from Password Stores: Credentials from Web Browsers</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(191, 191, 191); vertical-align: top; background-color: rgb(242, 246, 251); padding: 3pt 5.5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1027/" style="color: rgb(59, 130, 246);">M1027</a> / <a href="https://attack.mitre.org/mitigations/M1021/" style="color: rgb(59, 130, 246);">M1021</a> / <a href="https://attack.mitre.org/mitigations/M1051/" style="color: rgb(59, 130, 246);">M1051</a> / <a href="https://attack.mitre.org/mitigations/M1018/" style="color: rgb(59, 130, 246);">M1018</a> / <a href="https://attack.mitre.org/mitigations/M1017/" style="color: rgb(59, 130, 246);">M1017</a></td></tr><tr style="height: 0pt;"><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(191, 191, 191); vertical-align: top; padding: 3pt 5.5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/techniques/T1568/002/" style="color: rgb(59, 130, 246);">T1568.002</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(191, 191, 191); vertical-align: top; padding: 3pt 5.5pt; overflow: hidden; overflow-wrap: break-word;">Dynamic Resolution: Domain Generation Algorithms</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(191, 191, 191); vertical-align: top; padding: 3pt 5.5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1031/" style="color: rgb(59, 130, 246);">M1031</a> / <a href="https://attack.mitre.org/mitigations/M1021/" style="color: rgb(59, 130, 246);">M1021</a></td></tr></tbody></table></div>