New ClickFix Attack Deploys Lorem Ipsum Malware Loader to Establish Remote Access
A ClickFix campaign uses the Lorem Ipsum loader to install a Python tunnel for covert remote access.
A ClickFix campaign uses the Lorem Ipsum loader to install a Python tunneling implant that can relay arbitrary TCP traffic and serve as a network pivot. In a late-September incident, a ZIP combined a legitimate executable, a malicious DLL, and a batch file; the DLL was sideloaded, persisted via a user Run key and scheduled task, reconstructed shellcode from a word dictionary, unhooked ntdll, and used process injection. Another path used a trojanized Microsoft Teams MSI and staged PowerShell. The loader contacts a dead-drop resolver, then runs client.py over a TLS WebSocket. Investigators assessed ransomware as a likely objective, but encryption was not observed; the family resembles but is not confirmed to be a later Axolotl Loader.