From ClickFix to C2: Comparative Analysis of Two Malware Loaders

ClickFix social engineering campaigns have gained popularity since 2025. More recently, a wave of malware loaders delivered via ClickFix – including BabaDeda, Lorem Ipsum, Potemkin, and others – have become a favorite method to deploy ransomware.

In late September, we investigated an incident where threat actors leveraged ClickFix to deploy the Lorem Ipsum Loader malware and load a Python tunnel client into victims.

This particular tradecraft has previously been attributed to cybercriminal group Vice Society, which has operated several ransomware families, including Rhysida recently. The incident we investigated was contained before ransomware was deployed via the Python tunnel, but we believe that was the threat actor’s goal.

Public sources including Malpedia and ThreatFox mention two additional variant names for Lorem Ipsum: Axolotl and OAKGLINT. However, the connection between Lorem Ipsum and Axolotl has not been documented so far in public reports.

Following our incident response, we investigated five Lorem Ipsum samples retrieved from that attack as well as the 39 known samples of Axolotl Loader. The main novelties we discovered are:

• One additional delivery method for Lorem Ipsum, leveraging MSI installers and multi-stage PowerShell
• Lorem Ipsum’s use of an additional .cpoc section in DLLs to carry malicious resources
• The identification of three variants of Axolotl Loader, each with a different host program
• A comparative analysis, highlighting similarities and differences between the two loaders

Our analysis shows that both loader families have overlapping infrastructure and command-and-control (C2) message attributes. Although their code is distinct, they are functionally similar. We could not establish with certainty that Lorem Ipsum Loader is a later iteration of Axolotl, but that is likely given their similarities and previously reported timelines.

A Tale of Two Loaders: The Brief History of Axolotl and Lorem Ipsum

On February 22, an independent researcher identified almost 40 samples of a new loader malware and started tracking it as ‘AxolotlLoader’.

In April, BlueVoyant identified a campaign using SEO poisoning to distribute trojanized Microsoft Teams installers that also deployed a new loader they dubbed ‘Lorem Ipsum’. The campaign was active since February using a dead-drop resolver on letsdiskuss[.]com. That same campaign evolved in June by moving the resolver to digitalpoint[.]com and distributing the loader via ClickFix lures hosted on compromised websites.

BlueVoyant’s research also linked the loader to Rapid Brigantine (a.k.a. Vanilla Tempest, Vice Society, Vice Spider and several other aliases), a cybercriminal group that has deployed ransomware families such as Rhysida, BlackCat, and Quantum Locker.

In August, Field Effect noticed three other developments of this campaign:

• The loader was now distributed via trojanized versions of several other MSI installers, such as 3D PDF Maker Smart, Bitwarden VPN, and ESET Sysinspector.
• Another delivery mechanism leveraged NodeJS instead of MSI files.
• A third variant of the campaign retrieved domains hosting the ClickFix lure from the Polygon blockchain and relied on Python to execute the rest of the attack chain.

Also in August, Microsoft described a similar version of the campaign without naming the loader as Lorem Ipsum. Their report focused on the fact that the campaign used TerminalFix, a ClickFix variant where users are directed to Windows Terminal or PowerShell, instead of the traditional Run dialog.

Finally, at the end of September, Sophos reported they also investigated incidents in this campaign and split it in two phases:

• The first phase, between March and April, used SEO poisoning and trojanized Teams installers to deploy a PowerShell loader that communicated with letsdiskuss[.]com.
• The second phase, beginning in May, transitioned to TerminalFix and leveraged DLL sideloading, image-based steganography, Active Directory reconnaissance, and a Python reverse-tunnel implant.

Lorem Ipsum: Identifying Additional Delivery Mechanism

The incident we observed followed Lorem Ipsum’s traditional delivery mechanism depicted above and described below:

1. Each ZIP contains a clean signed Microsoft executable, a trojanized DLL that the executable loads, and a .bat file. We observed two pairs, vdsldr.exe with vdsutil.dll and CertEnrollCtrl.exe with CertEnroll.dll, always with the same 1.bat file.
2. Script 1.bat writes an HKCU Run registry value and creates a scheduled task for persistence. Both are named _<9 random characters>. For instance, we observed vdsldr_j6cx7eGEb and CertEnrollCtrl_L9k737tk9.
3. The scheduled task uses /sc minute /mo 60 and runs immediately, after which the batch file launches the clean executable and loads the malicious DLL.
4. The trojanized DLL carries an added .cpoc section and an RT_RCDATA resource holding 260 random five-letter words, which acts as a dictionary. After a stub of about 740 bytes, .cpoc holds the payload as NULL-separated words, each standing for its index in the dictionary. The decoded blob jumps over an embedded decoy JPEG and XORs the remaining content in 8-byte units. The result is a downloader shellcode that is functionally similar to the one from Axolotl loader with improvements for stealth and persistence.
5. The final stage unhooks ntdll from a fresh on-disk copy and calls VirtualProtect for EDR evasion. It then takes a single-instance mutex named for a per-sample UUID and drops a marker file of the same name. Finally, it relaunches a second copy of the sideload executable and injects itself into it, after which the original process exits.

Beyond this ZIP-and-DLL-sideload chain, previously reported Lorem Ipsum delivery methods include a Node.js dropper and standalone PowerShell scripts. While pivoting to other samples on VirusTotal, we also noticed a previously unreported staged MSI-to-PS1 execution that works as follows:

1. A trojanized MS Teams installer file (we observed MT_setup_v3.22.7182.msi with hash 13a3fa500e91e35a34f71e0e88f07a5b3dd8251e9b423188030e31dbd8eaf603) contains an intermediate PowerShell file (stage_03_aes_decrypted.ps1 with hash 074e58df3af3e83ca4fff7006ff6006b24b7182fde75fdbf894ee60161a6ed15).
2. Upon execution, the intermediate PowerShell decodes a string containing a GZIP-compressed version of a final stage (o1.ps1 with hash ec7c33d434af7635f202dd726f34e03304f9a7d839c4625d962515d655d190c5) as shown below.
   
3. After decompression, the final PowerShell (shown below) resolves kernel32 APIs, allocates executable memory, copies the encoded payload there, and executes it. The encoded payload performs the actions we described below in the ‘Command and Control’ section.
   

Regardless of delivery mechanism, the loader uses word-based shellcode encoding, GZIP or XOR decoding, dead-drop profiles on public forums (letsdiskuss[.]com or digitalpoint[.]com in other reported samples), persistence through HKCU Run keys or scheduled tasks, and the WinHTTP-based C2 communication detailed below.

Command and Control

All observed versions of the loader use WinHTTP with user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:143.0) Gecko/20100101 Firefox/143.0 to communicate with C2 servers.

First, the loader sends a GET request to letsdiskuss[.]com/user/. For the observed incident, the profile was lindawilliams51453 – contact lindawilliams@onionmail[.]org – but we also found samples with profiles dhuahsd12d2752 and joeblack1673 in the case of the MSI-to-PS1 delivery. The profile’s about field carries a C2 list framed by -=( and )=- and encoded using a dictionary. The C2 list in the observed incident decoded to scriptedgeapp[.]com, transferrootway[.]com and updaterdeskarc[.]com.

Then, the loader sends a POST request to /api/init/ with Content-Type: image/jpeg and an embedded decoy JPEG as the body. After this victim registration, the loader polls the C2 every five seconds waiting for a valid task. Beyond the three C2 domains listed above, VirusTotal shows other samples communicating with C2 host signinbyte[.]com and a second endpoint /api/cl/.

The final payload obtained from the C2 is a tunneling utility named client.py. This client follows the protocol described below.

The client establishes a TLS connection to the C2 and upgrades it to WebSocket at /tunnel. It then sends the per-sample UUID as a custom handshake message. The server can subsequently open arbitrary TCP streams through the client. CONNECT messages specify an IPv4, IPv6, or domain-based destination and port, after which the client relays traffic bidirectionally using its custom binary protocol. Multiple streams can remain active concurrently, with PING/PONG messages providing keepalive and a SHUTDOWN message allowing the server to terminate the client. The use of WebSocket over TLS and browser-like HTTP headers provides a benign-looking transport for the underlying tunnel, while the custom protocol supplies the remote server with a general-purpose TCP proxy capability.

The tunneling frame and message types follow the formats below.

 

 

AxolotlLoader: Analysis of Three Variants

AxolotlLoader is a standalone EXE loader. It encrypts a shellcode stage using the binary’s own embedded PNG image as a one-time-pad XOR key. The ciphertext is appended after the PNG IEND chunk inside a named PNG resource. The decrypted shellcode uses a distinct stack-junk obfuscator and acts as an intermediate step before reaching a final payload that behaves similarly to Lorem Ipsum’s final stage: resolve kernel32 APIs, allocate executable memory, copy an inner payload there, and execute it.

We analyzed the 39 samples originally identified as AxolotlLoader. All 39 share the signing certificate below, not seen for Lorem Ipsum, and none has a .cpoc section or a word-list resource like Lorem Ipsum.

 

We identified generational changes to AxolotlLoader that allowed us to cluster the samples as three different variants depending on their host program, their sections and how they reach the final shellcode that communicates with C2.

The figure and table below summarize these variants and how they share the same remaining execution flow.

 

Variant A1 includes 19 samples that store shellcode directly in .text section. In this case, the host binary’s legitimate code never runs. The binary is a complete fake.

Variant A2 includes 10 samples that contain a fothk section. The fothk section is a 16-byte 0xCC (int 0x3) sled with an E9 JMP at offset +0x10. This provides a code-redirect trampoline inserted into the trojanized host binary to divert execution from the legitimate entry path into the malicious loader.

Variant B includes 10 samples where the ieinstal.exe host contains Detours sections .detourc and .detourd and imports RegisterTypeLibForUser. The trojan redirects HKLM and HKCR to HKCU with RegOverridePredefKey, hooks RegisterTypeLib, and can write ICDRegOCX RunOnce values that call rundll32.exe IEAdvpack.dll, RegisterOCX. These routines sit in RegisterDllFile2Helper, the method behind the IActiveXInstallBroker class {BDB57FF2-79B9-4205-9447-F5FE85F37312}. Windows registers that CLSID to IEInstal.exe. The naming and the CLSID suggest Microsoft’s own add-on installer logic, which the trojanizer left intact.

Lorem Ipsum and Axolotl: Comparative Analysis

The sections above highlighted how both loaders share similarities in their final shellcode. Additionally, the observed infrastructure for both families concentrates on the same ASN.

 

But there are also several fundamental differences in both families:

• Lorem Ipsum obtains C2 domains from a dead-drop resolver, while Axolotl’s C2 is hardcoded in the shellcode.
• Lorem Ipsum uses UUID’s created from marker files or process arguments, while Axolotl uses per-sample hardcoded UUID.
• Lorem Ipsum adopts process injection and ntdll unhook for EDR evasion, while Axolotl does neither.
• Lorem Ipsum supports threading, which Axolotl does not.

The table below summarizes their main behavioral similarities and differences.

TTPs – Detection and Hunting

 

Indicators of Compromise (IoCs)

Confirmed Network IoCs

Domains Obtained Via Pivoting, Not Individually Confirmed

Lorem Ipsum Samples

Axolotl Samples