ClickFix Campaigns Expand Delivery with New Loaders and Fake Lures

Threat actors are increasingly utilizing ClickFix social engineering tactics to distribute a new wave of malware loaders across high-value sectors. According to The Hacker News, recent investigations by security firms Morphisec, BlueVoyant, and Huntress have identified the deployment of three distinct loaders: BabaDeda Loader, Lorem Ipsum Loader, and Potemkin. These campaigns represent a significant evolution in the TTP employed by adversaries, shifting from simple Phishing to complex, multi-stage delivery mechanisms that exploit human trust in browser-native prompts.

Technical Breakdown of the ClickFix Evolution

The ClickFix methodology relies on displaying fraudulent overlays on compromised or malicious websites. These overlays typically inform the user that their web browser or a specific plugin requires an update to view the content correctly. Instead of a standard download link, the user is instructed to copy a PowerShell command to their clipboard and run it via the Windows ‘Run’ dialog or a terminal. This bypasses traditional EDR detections that focus on file downloads, as the malicious code is executed directly in memory or through legitimate system utilities.

Analyzing the BabaDeda Loader Shift

Historically associated with targeting the cryptocurrency and gaming communities, the BabaDeda Loader has pivoted toward broader targets. In campaigns observed in April 2026, researchers noted a shift toward education and financial organizations. When security teams perform a Lorem Ipsum Loader technical analysis, they often find that these tools are designed to facilitate initial access, allowing the threat actor to establish a C2 channel for further exploitation.

The BabaDeda Loader is particularly effective due to its obfuscated nature and its ability to deliver secondary payloads like Ransomware or info-stealers. By masquerading as a fix for browser display issues, it lowers the victim’s guard, leading to successful Privilege Escalation if the user executes the command with administrative rights.

Lorem Ipsum Loader and Potemkin Discovery

Beyond BabaDeda, the emergence of the Lorem Ipsum Loader and Potemkin illustrates a diversifying threat landscape. These loaders are often the first stage in a MITRE ATT&CK chain that ends in data exfiltration or environment-wide compromise. To defend against these threats, organizations must understand how to detect ClickFix malware lures by monitoring for unusual PowerShell executions initiated by browser processes (e.g., chrome.exe or msedge.exe) or the ‘run’ box (explorer.exe).

TTPs and Delivery Mechanisms

The sophistication of these ClickFix campaigns lies in their ability to mimic legitimate troubleshooting steps. The lure often provides a ‘copy’ button, which places a Base64-encoded or obfuscated PowerShell script into the user’s clipboard. This script typically connects to a remote server to fetch the final payload, which could lead to Lateral Movement within the internal network.

Security professionals should note that these campaigns do not rely on a specific CVE to compromise the system. Instead, they exploit the “human Zero-Day” by using psychological pressure. Without a technical vulnerability to patch, the SOC must rely on behavioral analysis and telemetry from SIEM platforms to identify IoC associated with these loaders.

Recommended Mitigations for ClickFix Campaigns

Effective defense requires a Zero Trust approach to browser-initiated system changes. Organizations should prioritize the following BabaDeda loader mitigation steps:

• PowerShell Execution Policies: Implement Constrained Language Mode and restrict the ability of standard users to execute PowerShell scripts, especially those passed via command-line arguments.
• User Awareness Training: Educate employees on the dangers of ‘ClickFix’ lures, emphasizing that no legitimate software update will ever require a user to manually copy and paste commands into a terminal.
• Endpoint Monitoring: Configure security tools to alert on cmd.exe or powershell.exe being spawned with suspicious parent processes or containing long, obfuscated command strings.
• Web Filtering: Use threat intelligence feeds to block access to known domains hosting ClickFix overlays and malicious scripts.