ClickFix Campaigns Delivering Potemkin, BabaDeda, and Lorem Ipsum

In early 2026, multiple threat intelligence sources identified a massive shift in initial access tradecraft toward 'ClickFix' lures. These campaigns use compromised WordPress sites and fake browser/CAPTCHA update prompts to trick users into executing malicious commands via the Windows Run dialog (Win+R) or terminal. Major financially motivated groups, notably Rapid Brigantine (Vanilla Tempest), have pivoted to this model following disruptions to their previous code-signing infrastructure, effectively bypassing the need for signed installers while maintaining high infection rates.

Technically, the campaigns are characterized by modular staging and living-off-the-land techniques. Attackers frequently deploy a primary loader—such as Potemkin or BabaDeda—which then fetches advanced post-exploitation tools like RMMProject or EtherRAT. These tools feature advanced capabilities, including Chrome App-Bound Encryption (ABE) bypass for credential theft, hidden-desktop remote control (RTSC), and blockchain-based C2 resolution (Etherhiding) via Ethereum and Binance Smart Chain contracts. Lateral movement typically involves WMIExec and SMBExec to distribute secondary payloads across the network.

This activity represents a significant threat to educational, financial, and manufacturing sectors. The use of legitimate binaries (Node.js, mshta.exe) and memory-only execution makes these attacks difficult to detect with traditional signature-based tools. Defenders must prioritize behavioral monitoring of the Windows Run dialog and parent-child process relationships between browsers and administrative utilities.