Three New Loaders Ride the ClickFix Wave: BabaDeda, Lorem Ipsum, and Potemkin

Key points

• Three loader families, BabaDeda, Lorem Ipsum, and Potemkin, have each been tied to ClickFix delivery by separate research teams.
• BabaDeda activity in April 2026 hit education and financial organizations, a shift from its earlier targeting profile.
• All three loaders rely on the victim pasting an attacker-supplied command into Windows Run or a terminal: no exploit required.
• Infrastructure and payload overlap between the three families is plausible but unconfirmed across the vendor reports.
• ClickFix has moved from novelty to default initial-access technique for commodity loader operators.

Three different research teams have tied a fresh batch of malware loaders to ClickFix, the social-engineering trick that walks victims into pasting attacker-supplied commands into the Windows Run dialog or a terminal. The loaders were documented independently: Morphisec on BabaDeda, BlueVoyant on Lorem Ipsum, and Huntress on Potemkin.

BabaDeda activity observed in April 2026 hit education and financial organizations. That's a notable pivot from earlier BabaDeda campaigns, which had a different victimology profile, and worth flagging for anyone mapping the cluster to prior reporting. We first covered BabaDeda on 16 June 2026.

ClickFix itself is not new. A lure page, typically a fake CAPTCHA or a bogus document-verification screen, instructs the user to press Win+R, paste a clipboard payload the page silently populated, and hit enter. The pasted command calls mshta or powershell to stage the next loader. No exploit, no macro warning, no SmartScreen prompt. The user does the privileged action themselves. As we reported on 28 May 2026, attackers had already turned 700 compromised Ghost CMS sites into ClickFix watering holes using exactly this mechanic.

What's different here is the parallelism. Three separate loaders, three separate operator sets, all converging on the same initial-access technique within the same reporting window. Treat that as a signal about technique adoption, not a single campaign.

Should you worry?

Yes, proportionally. ClickFix bypasses most of the controls defenders have spent years tuning, because the victim supplies the privileged action. The kill chain has no exploit to patch.

What should defenders do right now?

Four practical moves, roughly in order of ease:

• Clipboard-hijack detection in the browser layer is the cleanest upstream catch. Some EDRs flag navigator.clipboard.writeText calls from low-reputation domains.
• Group Policy can disable the Run dialog via NoRun under HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer. It's a blunt instrument that breaks legitimate admin workflows, so scope it to high-risk user groups.
• User awareness messaging matters more than usual here. "No legitimate site will ever ask you to paste a command" is the message worth repeating.

IOCs and loader-specific behavior differ across the three families and are best pulled from each vendor's writeup directly.

How confident should we be in the vendor reports?

The three reports use separate naming conventions. Overlap between BabaDeda, Lorem Ipsum, and Potemkin at the infrastructure or payload level is plausible but unconfirmed. Treat the loader names as analytic conveniences rather than evidence of cleanly separated actors.

The broader read: ClickFix has graduated from a curiosity to a default initial-access technique for commodity loader operators. Expect more families to adopt it, not fewer, through the rest of the year.