Three New Loaders Ride the ClickFix Wave: BabaDeda, Lorem Ipsum, and Potemkin

Three different research teams have tied a fresh batch of malware loaders to ClickFix — the social-engineering trick that walks victims through pasting attacker-supplied commands into the Windows Run dialog or a terminal.

The loaders are BabaDeda Loader, Lorem Ipsum Loader, and Potemkin. Each was documented independently. Each rides the same delivery pattern.

BabaDeda activity observed in April 2026 hit education and financial organizations. That's a notable pivot. Earlier BabaDeda campaigns had a different victimology profile, which is worth flagging for anyone trying to map the cluster to prior reporting.

ClickFix itself is not new. The mechanic is straightforward: a lure page (often a fake CAPTCHA, a fake browser-update prompt, or a bogus document-verification screen) instructs the user to press Win+R, paste a clipboard payload that the page silently populated, and hit enter. The pasted command typically calls mshta, powershell, or curl to stage the next-stage loader. No exploit, no macro warning, no SmartScreen prompt to click past. The user does the privileged action themselves.

That's why loader authors keep migrating to it. It sidesteps a lot of the controls defenders have spent the last five years tuning.

What's different here is the parallelism. Three separate loaders, three separate operator sets, all converging on the same initial-access technique within the same reporting window. Treat that as a signal about technique adoption rather than a single campaign.

Operational notes for defenders:

• Audit your environment for execution chains that start with explorer.exe spawning powershell.exe, mshta.exe, or cmd.exe with a command line containing base64 or a remote URL. That's the canonical ClickFix telemetry.
• Group Policy can disable the Run dialog (NoRun under HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer). It is a blunt instrument and breaks legitimate admin workflows, but it's worth scoping for high-risk user groups.
• Clipboard-hijack detection in the browser layer (some EDRs flag navigator.clipboard.writeText writes from low-reputation domains) is the cleanest upstream catch.
• User awareness messaging matters more than usual here, because the kill-chain requires the user to type into Run themselves. "No legitimate site will ever ask you to paste a command" is the message.

IOCs and loader-specific behavior differ across the three families and are best pulled from each vendor's writeup directly rather than aggregated.

A few caveats. The three reports were published by separate vendors and use separate naming conventions, so overlap between BabaDeda, Lorem Ipsum, and Potemkin at the infrastructure or payload level is plausible but unconfirmed. Treat the loader names as analytic conveniences, not as evidence of three cleanly separated actors.

The broader read: ClickFix has graduated from a curiosity to a default initial-access technique for commodity loader operators. Expect more, not fewer, families to adopt it through the rest of the year.