New DeepLoad Malware Uses ClickFix and AI-Generated Evasion to Breach Enterprise Networks
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
A newly discovered malware named DeepLoad is targeting enterprise environments, turning a single user action into persistent, credential-stealing access that survives reboots and outlasts standard cleanup efforts. <\/p>\n
What sets this campaign apart is how every stage of the attack was deliberately built to defeat the security controls that most organizations already depend on.<\/a><\/p>\n DeepLoad arrives through ClickFix, where attackers display a fake browser error page and instruct employees to paste a PowerShell command into their Windows Run dialog to \u201cfix\u201d it. <\/p>\n That one command creates a scheduled task that re-executes the loader on every reboot and uses mshta.exe, a legitimate Windows utility, to fetch an obfuscated payload from attacker-controlled infrastructure. <\/p>\n The staging domains were already serving malicious content within 22 minutes of going live, giving response teams very little time to act.<\/a><\/p>\n ReliaQuest analysts and researchers identified this campaign<\/a> while investigating active enterprise compromises. Their findings showed the full attack chain was built to outpace manual response from the very start. <\/p>\n Credential theft<\/a> begins before the main chain finishes, and the malware spread to USB drives within ten minutes of infection, making the first host unlikely to be the only impacted system.<\/a><\/p>\n The immediate business risk is real. DeepLoad drops a credential stealer called filemanager.exe \u2014 named to blend into any process list \u2014 that runs on its own command-and-control channel and steals data even if the primary loader is blocked. <\/p>\n A malicious browser extension<\/a> captures passwords and session tokens as users type them, persisting across sessions until removed. The malware also wrote over 40 disguised installer files to connected USB drives, including fake shortcuts for Chrome, Firefox, and AnyDesk, each ready to trigger a full infection on any machine they touch.<\/a><\/p>\n Standard cleanup alone is not enough. A hidden WMI event subscription planted during the initial compromise sits outside standard remediation workflows, leaving the host ready to reinfect itself with no user action required. <\/p>\n In one confirmed case, that subscription fired three days after the host appeared clean and silently dropped filemanager.exe back into the user\u2019s Downloads folder.<\/a><\/p>\n DeepLoad avoids detection at every layer, making it hard to catch with traditional security tools. Its PowerShell loader is padded with thousands of meaningless variable assignments that make the script appear busy without performing any real work. <\/p>\n The actual logic \u2014 a short XOR decryption routine \u2014 sits at the bottom and decrypts shellcode in memory, so no decoded payload touches disk. <\/p>\n ReliaQuest researchers assessed with high confidence that AI generated this obfuscation layer, meaning new variants can be rebuilt and redeployed quickly before defenders have time to adjust detection coverage.<\/a><\/p>\n Once running, the loader uses PowerShell\u2019s Add-Type feature to compile a fresh C# injector on the fly, producing a randomly named DLL that signature-based tools cannot match. <\/p>\n The malware then selects a trusted Windows process to inject into \u2014 on investigated hosts, it chose LockAppHost.exe, the Windows lock screen process. <\/p>\n Since the LockAppHost.exe does not typically initiate outbound connections, most security tools<\/a> are not configured to monitor it. <\/p>\n Through asynchronous procedure call (APC) injection, the loader places shellcode into that process\u2019s memory and triggers execution on resume, leaving no decoded payload on disk.<\/a><\/p>\n Security teams should enable PowerShell Script Block Logging, since it captures decoded runtime commands and cuts through obfuscation. <\/p>\n All WMI event subscriptions on affected hosts must be explicitly audited and cleared before any machine returns to production, as a surviving subscription can re-execute the attack days after cleanup. <\/p>\n Every credential reachable from a confirmed infected host \u2014 saved passwords, session tokens, and active accounts \u2014 must be rotated immediately. <\/p>\n All USB drives connected to affected endpoints should be audited before reuse. Browser extensions outside approved IT deployment paths must be removed from affected systems. <\/p>\n Endpoint monitoring should shift from file-based scanning to behavioral, runtime detection using EDR telemetry and memory scanning.<\/p>\n Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates<\/strong>,\u00a0Set CSN as a Preferred Source in\u00a0Google<\/a>.<\/strong><\/p>\n The post New DeepLoad Malware Uses ClickFix and AI-Generated Evasion to Breach Enterprise Networks<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\nAI-Powered Evasion and Process Injection<\/strong><\/h2>\n