New ClickFix Attack Deploys Lorem Ipsum Malware Loader to Establish Remote Access

A ClickFix campaign uses the Lorem Ipsum Loader to install a Python-based tunneling implant, giving attackers a covert route into victims’ networks and potentially laying the groundwork for ransomware deployment.

In an incident investigated in late September, defenders contained the intrusion before ransomware was deployed; the tunnel’s remote-access capability nevertheless made the compromised host a potential foothold for further activity.

In the related TerminalFix variant, victims are instructed to open Windows Terminal or PowerShell and paste a command.

The command launches a multistage infection chain rather than completing the supposed verification.

In the observed chain, a ZIP archive contains a legitimate executable, a malicious DLL and a batch file.

The executable loads the DLL through sideloading, allowing the malicious code to run in the context of a trusted-looking program.

The batch file establishes persistence using a user-level Run key and a scheduled task before launching the executable.

The DLL carries a concealed payload in an additional .cpoc section. Researchers found a resource containing a dictionary of random five-letter words: the loader uses the words’ positions to reconstruct shellcode, then decodes the payload.

The final stage also unhooks ntdll from a clean on-disk copy and uses process injection techniques that can make analysis and detection more difficult.

Investigators also identified a separate delivery route using a trojanized Microsoft Teams MSI installer and staged PowerShell scripts.

The first script decodes and decompresses a second stage, which allocates executable memory and runs the payload.

Together with previously reported Node.js and standalone PowerShell delivery methods, the findings show that the loader can be delivered through multiple execution chains.

After contacting a dead-drop resolver hosted on a public forum, the loader retrieves command-and-control (C2) domains and registers the infected host.

Lorem Ipsum Malware Deployment

The researchers observed the loader sending HTTP requests with a browser-like user agent and JPEG-formatted traffic. It then retrieves client.py, a Python tunneling client.

Forescout Researchers said that, ClickFix lures manipulate users into running commands themselves, often by presenting a fake verification or update prompt.

AxolotlLoader is a standalone EXE loader. It encrypts a shellcode stage using the binary’s own embedded PNG image as a one-time-pad XOR key.

The client connects to its C2 server over TLS and upgrades the connection to WebSocket. Using a custom protocol, it can relay arbitrary TCP traffic through the victim’s machine, with message types for opening connections, transferring data, keeping streams alive and shutting the implant down.

That capability can turn an infected endpoint into a network pivot point, allowing an operator to reach systems otherwise inaccessible from outside.

The incident investigators assessed ransomware deployment as a likely objective, but the observed infection was contained before encryption.

Sophos has likewise reported TerminalFix activity involving Lorem Ipsum and a Python tunnel, while noting that it did not observe encryption in the activity it analyzed.

Researchers compared five Lorem Ipsum samples from the incident with 39 samples of Axolotl Loader, which had previously been tracked as a separate family.

The loaders share functional similarities, overlapping infrastructure and some C2 characteristics, but differ in code and implementation.

Axolotl samples use a PNG-based XOR technique and hardcoded C2 information; the analyzed Lorem Ipsum samples use word-based encoding, a dead-drop resolver and WinHTTP.

The analysis identified three Axolotl variants distinguished by their host programs and execution flow.

Researchers said they could not establish conclusively that Lorem Ipsum is a later iteration of Axolotl, though the similarities and reported timelines make that a possibility.

Organizations should train users not to paste commands into Terminal or PowerShell in response to web-page prompts.

Security teams should monitor for suspicious DLL sideloading, MSI-launched PowerShell, Node.js execution and standalone PowerShell activity, as well as unexpected Run-key values and scheduled tasks.

Hunt for relevant process and network activity, including connections to campaign indicators, using current threat-intelligence feeds; indicators can change as operators rotate infrastructure.

Microsoft’s related TerminalFix analysis also recommends restricting scripting tools where practical, enabling PowerShell script-block logging and investigating affected systems as potential network pivot points.

IOCs

Indicator	Context
scriptedgeapp[.]com	Lorem Ipsum Loader C2
213.109.203[.]107	Lorem Ipsum Loader C2
transferrootway[.]com	Lorem Ipsum Loader C2
45.66.249[.]57	Lorem Ipsum Loader C2
updaterdeskarc[.]com	Lorem Ipsum Loader C2
185.28.119[.]81	Lorem Ipsum Loader C2

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.