BabaDeda Loader Uses ClickFix and Multi-Stage In-Memory Execution to Deliver Malware
Summary
Morphisec reports that a new BabaDeda-linked campaign targets education and financial organizations using ClickFix, staged PowerShell, DLL sideloading, and in-memory execution to deploy information stealers and RATs.
Key points
- Morphisec says it prevented multiple intrusion attempts against education and financial organizations in April 2026 and linked the activity to the BabaDeda loader family.
- The infection begins with a fake verification or CAPTCHA prompt that tricks users into running an attacker-supplied PowerShell command.
- The loader stages components separately, stores payloads in ordinary-looking files, and uses in-memory execution to reduce useful disk artifacts.
- A branch delivers a .NET backdoor and information stealer capable of profiling hosts and harvesting browser cookies, saved credentials, and files.
- Another branch uses a legitimate executable to sideload a malicious DLL, decode payload bytes from an external file, and execute shellcode through a Windows callback.
- Reported payloads include DanaBot and the SectopRAT stealer; the loader also checks system locale and exits on Russian or Belarusian systems.
Article Details
- Attack Vectors
- ClickFix prompts users to run attacker-supplied PowerShell commands.
- The command downloads and runs a script in memory, which launches hidden PowerShell and stages additional components.
- A package disguised as a normal application uses a legitimate executable to sideload a malicious DLL.
- The malicious DLL reads and decodes payload bytes from an external storage file, then passes execution to another DLL that runs shellcode in memory.
- Defensive Notes
- The article recommends preventing malicious code execution rather than relying on file signatures or reputation-based detection.
- It describes Automated Moving Target Defense (AMTD) as morphing the runtime memory environment to block evasive payloads.
- The article says Morphisec prevented the reported campaigns, but provides no specific defensive configuration or deployment steps.
MITRE ATT&CK
T1005 · Data from Local SystemThe information stealer can collect files from the host on demand.T1027 · Obfuscated Files or InformationThe loader decodes payload bytes from an external storage file using an XOR transform.T1055 · Process InjectionThe loader injects follow-on payloads into a trusted Windows process such as svchost.exe.T1059.001 · PowerShellThe ClickFix prompt leads victims to run attacker-supplied PowerShell commands; PowerShell also downloads and runs a script.T1105 · Ingress Tool TransferThe PowerShell script and loader retrieve follow-on components and payloads.T1518.001 · Security Software DiscoveryThe loader enumerates security products.T1555.003 · Credentials from Web BrowsersThe information stealer can harvest browser cookies and saved credentials.T1573 · Encrypted ChannelThe backdoor opens an encrypted channel to a command-and-control server.T1574.002 · DLL Side-LoadingA legitimate executable is used to sideload a malicious DLL.T1620 · Reflective Code LoadingThe described loaders map and run code directly in memory, including shellcode passed through a Windows callback function.
People
Malware
BabaDedaDuring April 2026, Morphisec prevented multiple intrusion attempts against education and financial organizations and uncovered a significantly evolved version of the BabaDeda loader family.DanabotThe downstream families in this set include DanaBot and the SectopRAT stealer, along with additional staging components.SectopRATThe downstream families in this set include DanaBot and the SectopRAT stealer, along with additional staging components.
Vendors
Products
Microsoft WindowsThe loader checks the victim region and quits on Russian or Belarusian systems, then pulls follow on payloads over plain HTTP and injects them into a trusted Windows process such as svchost.exe.Morphisec Anti-Ransomware Assurance SuiteThe Morphisec Anti-Ransomware Assurance Suite pairs AMTD with deception and adaptive AI driven defense to disrupt the chain before a stealer, RAT, or ransomware payload can establish a foothold.
Tools
DonutIn memory execution: Donut and pe2shc style loaders map and run code directly in memory rather than dropping a clean executable to disk.pe2shcIn memory execution: Donut and pe2shc style loaders map and run code directly in memory rather than dropping a clean executable to disk.PowerShellFrom there it transitions into a multi stage loader that chains hidden PowerShell, in memory shellcode, DLL sideloading, external payload storage, and callback based execution to deliver information stealers and remote
Countries
Industries
EducationDuring April 2026, Morphisec prevented multiple intrusion attempts against education and financial organizations and uncovered a significantly evolved version of the BabaDeda loader family.financialDuring April 2026, Morphisec prevented multiple intrusion attempts against education and financial organizations and uncovered a significantly evolved version of the BabaDeda loader family.