New ClickFix Variants: BabaDeda & Potemkin Infecting via Fake Updates
Has anyone else started seeing indicators for the new wave of ClickFix campaigns? I was reviewing the reports from Morphisec and Huntress this morning, and the evolution of these loaders is concerning.
We are seeing three distinct loaders now—BabaDeda, Lorem Ipsum, and Potemkin—being distributed primarily through fake browser update lures. The BabaDeda loader specifically seems to be targeting education and financial orgs. The scary part is how these "ClickFix" attacks manipulate users into calling PowerShell commands or HTA files under the guise of fixing a display issue or updating a video codec.
From a defensive perspective, these are hard to catch because the user initiates the action. I've been looking for specific parent-child process anomalies. Here is a KQL query I'm tuning to catch the specific behavior where a browser spawns a PowerShell shell with encoded commands:
DeviceProcessEvents
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe")
| where FileName == "powershell.exe"
| where ProcessCommandLine contains "FromBase64String" or ProcessCommandLine contains "DownloadString"
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, ProcessCommandLine
| order by Timestamp desc
Has anyone successfully blocked these at the network layer, or are we relying too heavily on endpoint detection? The social engineering aspect on these fake updates is getting incredibly convincing.
We've had some success blocking the initial vector by aggressively filtering HTA and JS files downloaded from the internet via our secure web gateway. However, the Potemkin loader is tricky because it often uses DLL side-loading or looks for legitimate signed binaries to hijack. We recently enabled Attack Surface Reduction (ASR) rules specifically for 'Block Office applications from creating child processes' and 'Block Win32 API calls from Office macros', which helped reduce the attack surface, though it generated some user noise initially.
The 'Lorem Ipsum' loader is interesting because researchers found it actually uses legitimate text strings to hide malicious code, often bypassing simple string-based detections. We caught a variant of BabaDeda last month that was using a heavily obfuscated PowerShell command wrapped in a fake Chrome error dialogue.
If you aren't already, I recommend enabling AMSI (Antimalware Scan Interface) logging for PowerShell. It catches a lot of these obfuscated scripts before they fully decrypt in memory. You can check if your endpoints are reporting AMSI events with this quick PowerShell snippet:
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; ID=4104} -MaxEvents 5 | Format-List TimeCreated, Message
Verified Access Required
To maintain the integrity of our intelligence feeds, only verified partners and security professionals can post replies.
Request Access