DeepLoad Malware - AI-Generated Evasion Targets Enterprises

What Happened

A newly discovered malware called DeepLoad is making waves in enterprise environments. This malware cleverly turns a single user action into persistent access that steals credentials and survives even after reboots. What sets DeepLoad apart is its ability to outsmart the security measures that most organizations rely on. It arrives through a method called ClickFix, where attackers trick employees into pasting a PowerShell command to fix a fake browser error.

This command creates a scheduled task that ensures the malware re-executes on every reboot. It uses mshta.exe, a legitimate Windows utility, to fetch an obfuscated payload from the attackers' servers. The speed of this attack is alarming; the malicious domains were serving content within just 22 minutes of going live, leaving little time for response teams to react.

Who's Being Targeted

DeepLoad primarily targets enterprise networks, making it a significant threat to businesses of all sizes. Once inside, it begins stealing credentials almost immediately. The malware spreads quickly, infecting USB drives within ten minutes of the initial compromise. This means that the first infected host is unlikely to be the only one affected, increasing the potential impact on the organization.

The malware drops a credential stealer named filemanager.exe, which blends into process lists to avoid detection. It operates on its own command-and-control channel, ensuring that data continues to be stolen even if the primary loader is blocked. Additionally, a malicious browser extension captures passwords and session tokens, persisting across user sessions until removed.

Signs of Infection

One of the most concerning aspects of DeepLoad is its ability to remain hidden. It plants a WMI event subscription during the initial compromise, which allows it to reinfect the host without any user action. In one instance, this subscription triggered three days after the host appeared clean, silently dropping filemanager.exe back into the user's Downloads folder.

Moreover, DeepLoad employs advanced evasion techniques. Its PowerShell loader is padded with meaningless variable assignments, making it look busy while the actual malicious logic sits hidden. This obfuscation layer is likely generated by AI, allowing for quick redeployment of new variants before defenders can adapt.

How to Protect Yourself

To combat DeepLoad, organizations must take immediate action. Enable PowerShell Script Block Logging to capture decoded runtime commands and bypass obfuscation. All WMI event subscriptions on affected hosts should be audited and cleared before returning any machine to production.

Furthermore, every credential accessible from an infected host must be rotated immediately. USB drives connected to affected endpoints should be thoroughly audited before reuse. Lastly, organizations should shift from traditional file-based scanning to behavioral detection methods using EDR telemetry and memory scanning to catch this sophisticated malware.