Back Technadu

Novel DeepLoad Malware Campaign: ClickFix and Possible AI-Backed Evasion

Technadu • March 31, 2026

The DeepLoad malware campaign utilizes the ClickFix delivery method to deceive users into executing malicious scripts, quickly establishing persistent network access before manual triage can occur. The malware persisted via Windows Management Instrumentation (WMI) event subscriptions that allowed reinfection three days after the host appeared clean

Security researchers at ReliaQuest have identified this sophisticated new threat in enterprise environments, and in the observed campaign, DeepLoad also spread via USB drives.

Once the ClickFix delivery method initiates the attack sequence, the payload likely relies on advanced AI-generated evasion to bypass static scanning protocols, the security researchers asserted , citing the vast amount of padding. After initial access via ClickFix, DeepLoad hides its payload inside LockAppHost.exe, the legitimate Windows lock screen process, via asynchronous procedure call (APC) injection.

The ClickFix command created a scheduled task to re-execute the loader. “ From there, mshta.exe, a legitimate Windows utility often abused for remote script execution, reached the attacker's staging infrastructure and pulled down an obfuscated PowerShell loader ,” the report added.

The PowerShell loader conceals its functional code beneath thousands of benign variable assignments that resemble routine scripting. A short exclusive OR (XOR) routine decrypted an in-memory shellcode container using a hardcoded key.

The DeepLoad malware introduces severe enterprise cybersecurity risks through rapid and persistent credential theft. Even if security administrators successfully block the primary loader, a standalone stealth component, filemanager.exe, continues to scrape stored system passwords. Simultaneously, a dropped malicious browser extension intercepts live user sessions and captures keystrokes in real time.

Furthermore, this malware campaign achieves long-term network persistence through hidden Windows Management Instrumentation (WMI) event subscriptions. To effectively mitigate these advanced enterprise cybersecurity risks, organizations must:

While the ErrTraffic ClickFix tool industrialized social engineering malware via fake website glitches in early 2026, a free ‘ClickFix Hunter’ tool was soon made available to track the growing social engineering epidemic.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

DeepLoad Malware Campaign Uses AI for Credential Theft and Evasion A new malware strain named 'DeepLoad' has been identified, capable of stealing credentials from enterprise networks immediately upon infection. The malware employs AI-generated code to obfuscate its logic, making it difficult for traditional security tools to detect. It is distributed via social engineering techniques known as ClickFix, which tricks users into executing commands that install the malware. Once installed, DeepLoad captures stored browser passwords and live keystrokes through a malicious browser extension. The malware utilizes a persistence mechanism that allows it to re-execute even after initial detection efforts. ReliaQuest researchers warn that the AI-driven obfuscation may lead to frequent updates, complicating detection efforts for security teams. The malware's ability to spread to connected USB drives further increases its impact across networks. Organizations are advised to shift their focus to behavioral detection methods to combat this evolving threat. 9 sources 70

Extracted Entities

Novel DeepLoad Malware Campaign: ClickFix and Possible AI-Backed Evasion

The full story

Extracted Entities

Attack Types (1)

Malware (2)

MITRE ATT&CK (7)

Platforms (1)

Tools (2)