Multiple cybersecurity firms have identified expanding ClickFix campaigns deploying three distinct malware loaders—BabaDeda Loader, Lorem Ipsum Loader, and Potemkin—using fake update lures to compromise targets. BabaDeda Loader attacks observed in April 2026 have specifically targeted education and financial sector organizations. These campaigns represent an evolution in social engineering tactics
Cybersecurity researchers have flagged multiple ClickFix campaigns that deliver three malware loaders called BabaDeda Loader, Lorem Ipsum Loader, and Potemkin, per independent reports from Morphisec, BlueVoyant, and Huntress, respectively. Attacks involving BabaDeda Loader, observed in April 2026, have targeted education and financial organizations. "Earlier BabaDeda activity was known for
Originally published at thehackernews.com
60-minute technical evaluation, no obligation. We'll map the ideas in this article to your environment.
