ReliaQuest Uncovers DeepLoad Malware Using ClickFix and AI Evasion to Steal Enterprise Credentials

Overview

• ReliaQuest researchers, who disclosed the campaign Monday, warn DeepLoad poses an immediate risk to business networks.
• The attack begins with a ClickFix scam that prompts users to paste a PowerShell command into the Windows Run box, which uses mshta.exe to fetch a loader.
• The loader hides its logic under AI-like code padding to dodge file scans, and researchers expect frequent variant updates that reduce defenders’ response time.
• DeepLoad compiles C# code in memory and uses APC injection to run inside the LockAppHost.exe lock-screen process, avoiding decoded payloads on disk.
• The malware persists by creating a hidden WMI event subscription that can re-execute the attack about three days after cleanup, and it also copies shortcut lures to USB drives to reach new machines.