Cybersecurity researchers have flagged multiple ClickFix campaigns that deliver three malware loaders called BabaDeda Loader, Lorem Ipsum Loader, and Potemkin, per independent reports from Morphisec, BlueVoyant, and Huntress, respectively.
Attacks involving BabaDeda Loader, observed in April 2026, have targeted education and financial organizations.
“Earlier BabaDeda activity was known for concealing malicious payloads inside legitimate looking installer packages,” Morphisec researcher Shmuel Uzan said. “This new framework keeps that same code genome but expands it into a far more capable loader built for stealth, evasion, and payload flexibility.”
The starting point of the attacks is a ClickFix social engineering attack that deceives users into running attacker-supplied PowerShell commands to deliver the loader, which is then used to drop information stealers and remote access trojans (RATs) by combining well-known techniques like hidden PowerShell, in-memory shellcode, DLL side-loading, and external payload storage.
The activity has been attributed to BabaDeda, a crypter service that was first documented by Morphisec in November 2021 in connection with a campaign targeting the cryptocurrency and Web3 sectors to distribute information stealers, RATs, and LockBit ransomware.
The loader is designed to profile the host, avoid running on Russian or Belarusian systems, and perform security product-related checks before retrieving the main payload and injecting it into a trusted Windows process such as “svchost.exe.”
One of the malware families delivered via BabaDeda Loader is a .NET backdoor and information stealer that can harvest sensitive data and establish an encrypted channel to a command-and-control (C2) server. The malware supports a wide range of functions, including –
- Collecting detailed system information
- Discovering installed browser profiles
- Extracting browser artifacts such as cookies, browsing history, saved credentials, preferences, and local-state encryption keys
- Traversing directories and selecting files based on configurable rules
- Reading and exfiltrating file contents
- Capturing screenshots and displaying information
- Executing shell commands or external processes and collecting output
- Transferring data back to the C2 server
- Using native Windows APIs for process interaction, memory operations, DPAPI access, Restart Manager behavior, and advanced file access
A second attack chain drops a ZIP archive that employs DLL side-loading to launch DanaBot and SectopRAT (aka ArechClient). What’s notable about these attacks is the use of a staged loader component dubbed Storage Crypter that reads the payload material from external storage-like files such as “List.Control.dat.”
“The visible application package appears legitimate, while malicious payloads remain hidden inside externally stored containers and are decoded only moments before execution,” Morphisec said. “This design minimizes forensic visibility,…
Source link
Disclaimer
We strive to uphold the highest ethical standards in all of our reporting and coverage. We blogs.grocliq.com want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It’s possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.
Website Upgradation is going on for any glitch kindly connect at [email protected]
