ClickFix Campaigns Deliver Multiple Malware Loaders Through Fake Update Lures

Security researchers have identified new ClickFix malware campaigns distributing three separate loaders named BabaDeda, Lorem Ipsum, and Potemkin. These malware loaders are delivered through fake update lures, with attacks detected by several independent cybersecurity firms targeting sectors including education and finance.

What happened

Cybersecurity firms Morphisec, BlueVoyant, and Huntress have independently reported on ClickFix campaigns employing three different malware loaders: BabaDeda Loader, Lorem Ipsum Loader, and Potemkin. The campaigns use fake software update prompts to lure victims into executing malicious payloads. BabaDeda Loader activity was first observed as recently as April 2026, targeting education and financial organizations.

Each research group identified a distinct loader variant linked to the ClickFix campaign, indicating a diversification in malware delivery tactics within these operations. The use of fake update lures remains a consistent social engineering strategy across these campaigns.

Why it matters

The emergence of multiple malware loaders under the ClickFix umbrella signals an evolution in the operators’ ability to evade detection and compromise targeted networks. By employing varied loaders, attackers increase their chances of successfully deploying payloads despite defensive measures.

Targeting critical sectors such as education and finance highlights the potential for substantial disruption and data compromise. Recognition of these loaders and their delivery methods helps defenders identify and mitigate ongoing threats posed by ClickFix campaigns.

What security teams should do

Security teams should remain vigilant for phishing attempts and deceptive software update prompts, as these are the primary infection vectors for these loaders. Reviewing endpoint detection logs for references to BabaDeda, Lorem Ipsum, or Potemkin loader behaviors can aid in early detection.

Implementing strict patch management and user awareness training about fake updates can reduce successful exploitation. Collaborating with threat intelligence providers for updated indicators tied to ClickFix campaigns will also support defensive measures.

Key technical details

The ClickFix campaigns deliver three distinct malware loaders: BabaDeda Loader, Lorem Ipsum Loader, and Potemkin. Each loader serves as an initial stage to deploy other malicious payloads on compromised hosts. The campaigns use fake update notifications to trick users into initiating the infection chain.

BabaDeda Loader, notably seen in April 2026 activity, has been linked to attacks on education and finance sectors. The differing loaders uncovered by Morphisec, BlueVoyant, and Huntress reflect ongoing development and modularity in ClickFix operators’ malware delivery techniques.

Affected organizations/products

Education and financial organizations have been identified as targets of attacks involving BabaDeda Loader within the ClickFix campaigns. The full scope of affected organizations or products related to Lorem Ipsum and Potemkin loaders has not been detailed in the reports.

Source attribution

https://thehackernews.com/2026/06/clickfix-campaigns-expand-malware.html