DeepLoad Malware Uses ClickFix to Target Windows Systems
Summary
ReliaQuest reports the first in-the-wild campaign distributing DeepLoad to Windows systems via ClickFix. The malware uses a PowerShell loader, process injection and credential-stealing components; USB spread was also observed, though its source is unclear.
Key points
- ReliaQuest observed DeepLoad distributed through ClickFix, which tricks users into pasting commands to resolve fake browser errors.
- The command launches a persistent PowerShell loader that creates a DLL with a different filename on each execution.
- The loader disables PowerShell command history and uses Windows core functions to evade monitoring.
- DeepLoad injects into LockAppHost.exe using APC injection, executing its payload in memory.
- A separate component steals credentials, while a rogue browser extension can intercept user activity and sensitive data.
- ReliaQuest observed spread via USB drives but could not determine whether DeepLoad or its operator provided that capability.
Article Details
- Event Type
- First reported in-the-wild campaign distributing DeepLoad malware using the ClickFix technique.
- Impact
- The campaign targeted Windows systems. DeepLoad can steal credentials, intercept browser activity and session data, and replace cryptocurrency wallet applications or browser extensions with fake variants. ReliaQuest also observed USB-drive spread but could not determine whether it was built into DeepLoad or staged by its operator.
MITRE ATT&CK
T1055 · Process InjectionDeepLoad was injected into LockAppHost.exe using asynchronous procedure call (APC) injection.T1059.001 · PowerShellThe pasted command led to persistent execution of a PowerShell loader.T1091 · Replication Through Removable MediaReliaQuest observed the malware spreading via USB drives, though it could not determine whether this was DeepLoad functionality or operator-staged.T1204.004 · Malicious Copy and PasteVictims were instructed to paste a command into Windows Run or a terminal, consistent with malicious copy-and-paste user execution.T1555.003 · Credentials from Web BrowsersDeepLoad was described as stealing credentials and intercepting saved passwords through a rogue browser extension.
Malware
Products
Microsoft WindowsNow, ReliaQuest says it observed the first in-the-wild campaign distributing DeepLoad to Windows systems, through the infamous ClickFix technique.PowerShellRun or a terminal to resolve a fake issue. The command resulted in the persistent execution of a PowerShell loader that dropped DeepLoad on the system.