DeepLoad Malware Uses ClickFix and AI Evasion to Hit Enterprise Networks

New “DeepLoad” malware is turning a single user click into fileless, credential‑stealing persistence inside enterprise networks, leveraging the ClickFix technique and AI-generated obfuscation to evade traditional defenses.

DeepLoad arrives via ClickFix a social engineering technique that instructs users to paste a “fix” command into Windows Run or a terminal, making the action appear to be a legitimate user operation rather than malware execution.

In this campaign, a single PowerShell command run with execution‑policy bypass pulled a remote loader and immediately created a scheduled task to re‑execute the malware, giving attackers reboot‑surviving access with no further interaction.

ReliaQuest researchers say the campaign shows how quickly new families can arrive “operationally mature,” defeating the file- and signature-focused controls many organizations still lean on.

The chain then abused mshta.exe to fetch an obfuscated PowerShell payload from a purpose‑built staging infrastructure that began serving malicious content within minutes, outpacing manual investigation workflows.

DeepLoad Malware

DeepLoad’s PowerShell loader is padded with thousands of meaningless variable assignments and references to benign‑looking domains, producing so much noise that static scanners struggle to isolate the small block of real logic at the bottom of the script.

ReliaQuest assesses with high confidence that AI was used to generate this padding, enabling rapid iteration of new variants and leaving defenders less time to tune signatures between waves.

The functional core decrypts shellcode in memory using a hard‑coded key and never writes the decoded payload to disk, which means traditional file‑based engines have nothing concrete to match.

To cut through the noise, researchers recommend enabling PowerShell Script Block Logging so defenders can see the decoded commands and in‑memory behavior rather than the surrounding junk.

Once running, DeepLoad hides inside trusted Windows processes to blend into normal activity, favoring LockAppHost.exe the lock screen process that rarely initiates network connections and often falls outside default monitoring.

Using Add‑Type, the loader compiles a C# injector on the fly into a temporary DLL with a random name, then uses native Windows API calls and APC injection to place shellcode into processes like LockAppHost.exe, makecab.exe, or Magnify.exe.

From there, DeepLoad focuses on credentials: a standalone stealer component (filemanager.exe) and a malicious browser extension scrape stored passwords and intercept keystrokes and sessions, and can continue exfiltrating to separate C2 channels even if the primary loader is blocked.

USB spread and WMI‑based reinfection

ReliaQuest observed DeepLoad spreading through USB drives, rapidly writing dozens of shortcut files masquerading as common installers in order to re‑trigger the infection chain when opened on other hosts.

Telemetry showed dedicated “/t1_usb” tracking paths on attacker infrastructure, indicating USB activity is explicitly handled in the backend.

Even after apparent cleanup, the campaign persisted through a hidden Windows Management Instrumentation (WMI) event subscription that dropped filemanager.exe back onto the host three days later, long after scheduled tasks and visible artifacts had been removed.

Because WMI subscriptions live in their own repository and leave no straightforward file traces, they are often missed by routine remediation, allowing a “clean” host to silently reinfect itself.

ReliaQuest and other experts emphasize that runtime, behavior‑based visibility is the only reliable way to detect DeepLoad and similar AI‑assisted campaigns.

Organizations should enable PowerShell Script Block Logging, monitor for suspicious mshta.exe activity and execution‑policy bypasses, and deploy EDR telemetry that can surface process injection, anomalous LockAppHost.exe behavior, and QueueUserAPC‑style techniques.

On impacted systems, defenders should explicitly audit and remove unauthorized WMI event subscriptions, treat all connected USB media as potentially compromised, and rotate all credentials used during the infection window, including browser‑saved passwords and active sessions.

As threat actors lean on AI to industrialize obfuscation and speed up malware iteration, detection strategies must focus on durable behaviors like ClickFix‑style user command execution and fileless process injection rather than brittle indicators that can change in a single new build.

IOCs

Artifact	Details
1432393691b415d0cd4680d9cee73e60896 fbe63300d9f0355c96e91817e4b1d	filemanager.exe
6AABA685669D779EF8BE8F7F4231096CFA FD0EF386F3897C5E2106C177724FC8	domain-resolver.js
holiday-updateservice[.]com	Staging domain
forest-entity[.]cc	Staging domain
AB450927B37E1B68E2BE68832C354AC600 E86E2545A904D4CA0EA283F2600CC2	api-client.js
271D57775FD188FFE13F2F717538427CD666 7F82127E9C637303236231A456FA	popup.html
hell1-kitty[.]cc	Supporting infrastructure

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.