Rapid Brigantine Lorem Ipsum ClickFix Campaign

BlueVoyant researchers have identified an active ClickFix campaign attributed with high confidence to Rapid Brigantine (Vanilla Tempest). The threat actor has shifted from distributing signed Microsoft Teams installers to using social engineering lures that trick users into running malicious PowerShell commands via Windows Terminal. This pivot is assessed as a reaction to the May 2026 disruption of Forging Marauder (Fox Tempest), which previously provided the group with fraudulently signed Microsoft certificates.

The attack chain utilizes a multi-stage infection process involving a portable Node.js runtime and custom word-position encoding to conceal malicious payloads. The ultimate objective is the deployment of the Lorem Ipsum Loader, which serves as a precursor to Rapid Brigantine's broader post-exploitation arsenal and the final delivery of Rhysida ransomware. This loader demonstrates operational continuity through its signature reconstruction routines and the use of social media dead-drop resolvers for C2 discovery.

The shift to ClickFix on compromised WordPress sites significantly broadens the potential victim pool. Given Rapid Brigantine's history of rapid progression from initial access to full domain compromise (often within 1-17 hours), these infections require immediate containment and high-priority response from SOC teams.