DeepLoad Uses ClickFix and WMI Persistence to Steal Browser Credentials
Summary
Researchers detail DeepLoad’s ClickFix delivery, credential theft, APC injection, USB spread and WMI reinfection. The article also describes Kiss Loader’s chain to Venom RAT; the scale of those attacks is unknown.
Key points
- A ClickFix lure tricks users into pasting a command into the Windows Run dialog; mshta.exe then launches an obfuscated PowerShell loader.
- DeepLoad reportedly uses AI-assisted obfuscation, disables PowerShell history and compiles DLLs with randomized filenames using Add-Type.
- The loader uses APC injection to run its payload inside trusted Windows processes, including LockAppHost.exe.
- DeepLoad steals browser passwords, installs a credential-intercepting browser extension and can spread through USB drives using renamed shortcuts.
- ReliaQuest says WMI event subscriptions let DeepLoad reinfect a host three days later without user or attacker interaction.
- A separate Kiss Loader campaign uses shortcut files and a multi-stage script chain to deploy Venom RAT, an AsyncRAT variant; the campaign’s scale is unknown.
Article Details
- Attack Vectors
- A ClickFix lure tricks users into pasting a PowerShell command into the Windows Run dialog; mshta.exe then downloads and runs an obfuscated loader.
- DeepLoad steals browser passwords and installs a malicious browser extension that intercepts credentials entered on login pages.
- DeepLoad copies malware-laced shortcuts to connected removable media, using names such as ChromeSetup.lnk, Firefox Installer.lnk, and AnyDesk.lnk.
- DeepLoad uses WMI event subscriptions to reinfect a previously clean host three days later without user or attacker interaction.
- Kiss Loader is distributed in phishing emails with Windows Internet Shortcut attachments that lead to a remote WebDAV resource hosted on a TryCloudflare domain.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationDeepLoad conceals functionality among meaningless variable assignments and uses an obfuscation layer assessed to have been AI-assisted.T1027.004 · Compile After DeliveryDeepLoad uses Add-Type to compile C# code into a temporary DLL during execution.T1055.004 · Asynchronous Procedure CallDeepLoad and the Kiss Loader chain use APC injection to execute payloads inside processes.T1059.001 · PowerShellThe ClickFix chain uses an obfuscated PowerShell loader, and DeepLoad disables PowerShell command history.T1059.003 · Windows Command ShellThe Kiss Loader chain retrieves and executes a batch script.T1059.007 · JavaScriptA JavaScript component in the Kiss Loader chain retrieves and executes a batch script.T1091 · Replication Through Removable MediaDeepLoad copies malware-laced shortcut files to connected USB drives to spread to other hosts.T1105 · Ingress Tool TransferThe Kiss Loader chain retrieves scripts and the loader from remote resources, including a WebDAV resource.T1176 · Software ExtensionsDeepLoad installs a malicious browser extension that intercepts credentials entered on login pages and persists across user sessions.T1204.004 · Malicious Copy and PasteThe ClickFix lure persuades users to paste a command into the Windows Run dialog.T1218.005 · Mshtamshta.exe is used to download and run the obfuscated PowerShell loader.T1546.003 · Windows Management Instrumentation Event SubscriptionDeepLoad creates a WMI event subscription to reinfect a clean host later.T1547.001 · Registry Run Keys / Startup FolderThe batch script in the Kiss Loader chain establishes persistence in the Startup folder.T1555.003 · Credentials from Web BrowsersDeepLoad extracts browser passwords from the infected host.T1566.001 · Spearphishing AttachmentKiss Loader is distributed through phishing emails carrying Windows Internet Shortcut attachments.
People
Malware
AsyncRATA separate campaign distributes Kiss Loader via Internet Shortcut attachments, which ultimately deploys Venom RAT/AsyncRAT using similar APC injection and persistence techniques.Deeploadfound a new campaign that uses the ClickFix social engineering lure to run an undocumented loader called DeepLoad, which leverages AI-assisted obfuscation, in-memory APC injection, and immediate credential theft toKiss Loaderuses WMI for stealthy reinfection and removable-media propagation, and a related campaign distributes Kiss Loader leading to Venom RAT deployment.VenomRATreinfection and removable-media propagation, and a related campaign distributes Kiss Loader leading to Venom RAT deployment.
Products
Microsoft WindowsDeepLoad hides inside legitimate Windows processes (e.g., LockAppHost.exe), compiles randomized temporary DLLs via Add-Type, uses WMI for stealthy reinfection and removable-media propagation, and a related campaignPowerShellClickFix lure tricks users into pasting PowerShell into the Run dialog, using mshta.exe to launch an obfuscated PowerShell loader.