Lorem Ipsum

Campaign infrastructure is consistently registered through NameCheap with Withheld-for-Privacy domain privacy service out of Iceland and weaponized within hours to days of registration

In October 2025, MSTIC publicly attributed and disrupted a Rapid Brigantine campaign distributing fake MSTeamsSetup.exe files hosted on Teams-themed malicious domains ... driven by SEO poisoning and malvertising.

The pivot to ClickFix lures hosted on compromised WordPress (WP) sites significantly broadens the potential victim pool.

MITRE ATT&CK Techniques ... T1588.001 (Obtain Capabilities: Malware)

MITRE ATT&CK Techniques ... T1588.005 (Obtain Capabilities: Exploits)

In the March 2026 iteration of the campaign, the operators relied on plainraw[.]com ... to serve gzip-compressed, hex-encoded PowerShell payloads under disposable /raw/<hex> URL paths embedded in the trojanized MSI installers.

MITRE ATT&CK Techniques ... T1608.001 (Stage Capabilities: Upload Malware)

MITRE ATT&CK Techniques ... T1608.002 (Stage Capabilities: Upload Tool)

MITRE ATT&CK Techniques ... T1608.004 (Drive-by Target)

The first phase, observed in March and April, relied on SEO-poisoned websites distributing trojanized Microsoft Teams MSI installers.

MITRE ATT&CK Techniques T1102.001 (Dead Drop Resolver) T1189 (Drive-by Compromise) T1204.004 (Malicious Copy and Paste)

MITRE ATT&CK Techniques ... T1195 (Supply Chain Compromise)

Both phases establish persistence through auto-run entries masquerading as legitimate Microsoft or software-update components, often reinforced with scheduled tasks.

“[ClickFix] substitut[es] the legitimacy of a validly signed installer with... a user voluntarily executing the malicious command in their own terminal.”

Victims execute a PowerShell command that downloads a ZIP archive... The malware then executes a series of PowerShell commands to conduct reconnaissance, gather information, and establish persistence.

...downloads a ZIP file and an outdated version of Node.js released in 2017 (version 7.10.1) to execute JavaScript-based payloads present within the archive...

The MSI file contains a custom action that executes the PowerShell loader component silently by incorporating the -WindowStyle Hidden flag

TerminalFix lures direct users to open a Windows Terminal window, where victims execute a PowerShell command.

The website displays an iframe, presenting the user with a fake pop up indicating that their browser is out of date. The iframe includes instructions on how to remediate, simply by opening up windows terminal ( wt.exe ) and pasting a command into the terminal.

Both phases establish persistence through auto-run entries masquerading as legitimate Microsoft or software-update components, often reinforced with scheduled tasks.

...including a batch script that sets up persistence by launching a DLL side-loading chain to execute a malicious DLL...

Both phases establish persistence through auto-run entries masquerading as legitimate Microsoft or software-update components.

Both phases establish persistence through auto-run entries masquerading as legitimate Microsoft or software-update components, often reinforced with scheduled tasks.

...including a batch script that sets up persistence by launching a DLL side-loading chain to execute a malicious DLL...

Both phases establish persistence through auto-run entries masquerading as legitimate Microsoft or software-update components.

Lorem Ipsum Loader attempts to evade entropy-based detections by storing shellcode bytes as English words rather than raw binary data.

The image files contain encoded data that the malware extracts and decodes to facilitate C2 communications.

the Lorem Ipsum loader begins by resolving various Windows libraries using the API LoadLibraryA ... then resolves specific corresponding APIs using GetProcAddress

Auto-run entries masquerad[e] as legitimate Microsoft or software-update components.

The MSI file contains a custom action that executes the PowerShell loader component silently by incorporating the -WindowStyle Hidden flag

newer versions employ a more sophisticated approach, rebuilding the payload through a substitution cipher-based decoding algorithm.

Following API resolution, the shellcode creates a mutex via CreateMutexA to prevent concurrent execution.

The MSI file contains a custom action that executes the PowerShell loader component silently by incorporating the -WindowStyle Hidden flag, concealing it from the end user

The second PowerShell code is responsible for decoding another Base64-encoded payload embedded within itself, decompress it using gzip, and reflectively loads it directly into memory for execution, ensuring it is never written to disk.

Next, the backdoor gathers information about the impacted host, storing the information in JSON.

The loader then communicates with the C2 servers using HTTP POST requests that appear to contain JPEG image files.

Lorem Ipsum Loader issues an HTTP request to an attacker-controlled profile hosted on the legitimate Letsdiskuss platform... to retrieve the current set of C2 servers.

C2 dead drops were stored in Digital Point user profiles; strings in profile information were decoded by the malware into command-and-control domains.

Each infection beacons to three redundant Cloudflare-fronted C2 domains using the same per-victim UUID, complicating takedown and rendering IP-based blocking ineffective.

The PowerShell command downloads a ZIP archive... It deploys a portable Python runtime... by downloading the legitimate Python embedded package from python.org.

the loader attempts to establish communication by transmitting its embedded JFIF image to the C2 server using a Content-Type: image/jpeg header rather than a conventional HTTPS request.