ReliaQuest Details DeepLoad’s ClickFix Delivery, Evasion and Persistent Credential Theft
Summary
ReliaQuest describes DeepLoad, a ClickFix-delivered campaign using an obfuscated PowerShell loader, in-memory APC injection, credential theft, USB spread and WMI persistence that triggered reinfection after cleanup.
Key points
- ClickFix prompts users to run a command that retrieves and executes an obfuscated PowerShell loader; a scheduled task supports persistence.
- The loader uses XOR decryption to run shellcode in memory and compiles a temporary C# injector, which uses APC injection to run payloads inside trusted Windows processes.
- A standalone stealer and malicious browser extension can capture saved and typed credentials and session data; the stealer uses a separate C2 channel.
- ReliaQuest observed USB propagation using disguised shortcut files, but says it is unclear whether this behavior is built into DeepLoad or was added by the threat actor.
- A WMI event subscription survived standard cleanup and re-executed the attack three days later.
- ReliaQuest assesses with high confidence that AI was used for the loader’s obfuscation; this is an assessment, not a confirmed finding.
- Recommended defenses include PowerShell Script Block Logging, behavioral monitoring, auditing WMI subscriptions and browser extensions, checking removable media, and rotating exposed credentials.
Article Details
- Attack Vectors
- ClickFix prompts tricked users into pasting and running an attacker-supplied PowerShell command that retrieved and executed a loader.
- The loader used obfuscation and XOR decryption to run a payload in memory, then used APC injection to execute it inside trusted Windows processes.
- A standalone credential stealer and a malicious browser extension captured stored and typed credentials, session tokens, and other browser data.
- The campaign spread through removable USB drives using installer-disguised shortcut files.
- Scheduled tasks and WMI event subscriptions provided persistence, including reinfection three days after apparent cleanup.
- Defensive Notes
- Enable PowerShell Script Block Logging and behavioral endpoint monitoring for in-memory execution and process injection.
- Monitor unexpected outbound connections from mshta.exe, anomalous QueueUserAPC activity, and newly created scheduled tasks.
- Enumerate and audit WMI event subscriptions during remediation; remove subscriptions that cannot be tied to a known legitimate source.
- Audit browser extensions on affected endpoints and remove unauthorized extensions.
- Treat removable media connected to affected hosts as potentially compromised and audit it before reuse.
- Rotate credentials and invalidate active sessions exposed during the infection window.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | forest-entity[.]cc | Domain listed as attacker infrastructure supporting the campaign. |
| DOMAIN | hell1-kitty[.]cc | Domain listed as supporting infrastructure for the campaign. |
| DOMAIN | holiday-updateservice[.]com | Attacker staging domain reported to serve malicious content. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe PowerShell loader buried its logic under thousands of meaningless variable assignments and used XOR-obfuscated payload data.T1041 · Exfiltration Over C2 Channelfilemanager.exe used a separate C2 channel to exfiltrate harvested credentials.T1047 · Windows Management InstrumentationWMI event subscriptions re-executed the attack after remediation, including a reported reinfection three days later.T1053.005 · Scheduled TaskA scheduled task was created to repeatedly re-execute the loader.T1055.004 · Asynchronous Procedure CallThe injector used APC injection, writing shellcode into a suspended process and triggering execution with QueueUserAPC.T1056.001 · KeyloggingThe malware captured credentials as users typed them.T1059.001 · PowerShellThe initial command used PowerShell with an execution-policy bypass to retrieve and execute the loader.T1091 · Replication Through Removable MediaThe campaign copied installer-disguised shortcut files to connected USB drives to spread to other hosts.T1105 · Ingress Tool TransferThe loader and supporting components were retrieved from attacker-controlled staging infrastructure.T1140 · Deobfuscate/Decode Files or InformationThe loader decrypted an in-memory shellcode container with an XOR routine without writing the decoded payload to disk.T1176 · Software ExtensionsA malicious browser extension was dropped and registered to capture credentials and session data across browser sessions.T1204 · User ExecutionClickFix social engineering induced users to paste and run attacker-supplied commands.T1218.005 · Mshtamshta.exe reached attacker staging infrastructure and retrieved the obfuscated PowerShell loader.T1546.003 · Windows Management Instrumentation Event SubscriptionA WMI event subscription provided persistence by re-executing the attack after cleanup.T1555.003 · Credentials from Web BrowsersThe campaign scraped saved browser passwords from infected hosts.
Malware
Vendors
Products
GreyMatter Agentic AIGreyMatter Agentic AI focuses on behavior across the kill chain rather than individual signals.GreyMatter TransitGreyMatter Transit provides visibility where file-based scanning fails.Microsoft Windows[T1047 ] Windows Management Instrumentation – WMI event subscriptions were created to re-execute the chain later, enabling reinfection after remediation.PowerShella fileless campaign called DeepLoad that uses ClickFix social engineering to execute an obfuscated PowerShell loader, compile an in-memory injector, and perform APC process injection into trusted processes like