ClickFix Campaigns Expand With New Stealthy Loaders

Multiple cybersecurity firms have identified an expansion in 'ClickFix' social engineering campaigns, which deceive users into executing malicious PowerShell commands under the guise of system updates or bot verification. These campaigns now utilize a new generation of modular loaders—BabaDeda, Lorem Ipsum, and Potemkin—to deliver secondary payloads including information stealers and Remote Access Trojans (RATs). Notable attribution includes the financially motivated actor Vanilla Tempest (also known as Vice Society), who has transitioned to these techniques following the disruption of their previous code-signing infrastructure.

The technical tradecraft has evolved from monolithic installers to staged delivery models. Attackers are increasingly using compromised WordPress sites for hosting lures and employing advanced evasion techniques such as DLL side-loading, in-memory execution, and Domain Generation Algorithms (DGA) for C2 discovery. In several instances, these initial infections have escalated to hands-on-keyboard activity, lateral movement via WMI/SMB, and the final deployment of Rhysida ransomware.

This activity represents a significant threat to sectors including Education, Financial Services, and Legal Services. The reliance on user-driven command execution (Win+R) bypasses many traditional perimeter defenses, making user awareness and terminal-level protections critical for mitigation.