DeepLoad malware uses ClickFix and AI-generated code to steal credentials
Security researchers at ReliaQuest identified a malware campaign called DeepLoad that uses the ClickFix social engineering technique combined with AI-generated code obfuscation to steal enterprise credentials and establish persistent network access. The malware hides functional code within large volumes of benign variable assignments designed to evade static security scanning tools.
What happened
DeepLoad malware combines the ClickFix social engineering technique with AI-generated evasion methods to steal enterprise credentials. The malware is delivered through links or files on compromised websites or SEO-poisoned search results, tricking users into executing malicious commands.
The payload hides inside legitimate Windows processes like LockAppHost.exe via asynchronous procedure call injection. The functional malicious code is buried beneath thousands of benign variable assignments, with researchers assessing that the volume and consistency of this obfuscation suggests AI-assisted code generation rather than human authorship.
Reported impact
The malware achieves rapid credential theft by scraping stored system passwords through a component called filemanager.exe, and intercepting live user sessions through a malicious browser extension. A hidden persistence mechanism using Windows Management Instrumentation allows the malware to reactivate itself even after attempted removal.
Index analysis
The large volume of padding and variable assignments in the code makes it difficult for file-based scanning tools to detect the malware. Researchers noted that the sheer scale of obfuscation likely rules out human authoring, and the use of AI suggests attackers could frequently alter the code to evade detection between waves.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.