DeepLoad Malware Uses ClickFix and WMI Persistence to Steal Browser Credentials

This article covers DeepLoad, a newly discovered malware loader that uses ClickFix social engineering, AI-assisted obfuscation, and WMI persistence to steal browser credentials.

• •Attack starts with a ClickFix lure tricking users into running PowerShell commands via the Windows Run dialog, using mshta.exe to download an obfuscated loader
• •DeepLoad hides its payload inside a legitimate Windows process (LockAppHost.exe) and disables PowerShell command history to avoid detection
• •Uses APC injection to run the main payload inside a trusted Windows process without writing a decoded payload to disk
• •Drops a malicious browser extension that intercepts credentials on login pages and persists across sessions
• •Spreads via USB drives using disguised filenames and uses WMI event subscriptions to reinfect clean hosts three days later with no user interaction