Back Thehackernews

DeepLoad Malware Uses ClickFix and WMI Persistence to Steal Browser Credentials

Thehackernews • March 30, 2026

New 2026 Ponemon research reveals where mature identity programs still fall short and what leading organizations are doing to close the gap.

AI agents need identity, but most teams are still figuring out how to implement it. This session cuts through the noise with a practical, production-ready framework.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

DeepLoad Malware Campaign Uses AI for Credential Theft and Evasion A new malware strain named 'DeepLoad' has been identified, capable of stealing credentials from enterprise networks immediately upon infection. The malware employs AI-generated code to obfuscate its logic, making it difficult for traditional security tools to detect. It is distributed via social engineering techniques known as ClickFix, which tricks users into executing commands that install the malware. Once installed, DeepLoad captures stored browser passwords and live keystrokes through a malicious browser extension. The malware utilizes a persistence mechanism that allows it to re-execute even after initial detection efforts. ReliaQuest researchers warn that the AI-driven obfuscation may lead to frequent updates, complicating detection efforts for security teams. The malware's ability to spread to connected USB drives further increases its impact across networks. Organizations are advised to shift their focus to behavioral detection methods to combat this evolving threat. 9 sources 70

Extracted Entities

DeepLoad Malware Uses ClickFix and WMI Persistence to Steal Browser Credentials

The full story

Extracted Entities

Attack Types (1)

Malware (2)

MITRE ATT&CK (2)