AI-Powered 'DeepLoad' Malware Steals Credentials, Evades Detection

CYBERATTACKS & DATA BREACHES THREAT INTELLIGENCE VULNERABILITIES & THREATS CYBER RISK NEWS AI-Powered 'DeepLoad' Malware Steals Credentials, Evades Detection The massive amount of junk code that hides the malware's logic from security scans was almost certainly generated by AI, researchers say. Jai Vijayan,Contributing Writer March 30, 2026 4 Min Read SOURCE: GRENAR VIA SHUTTERSTOCK Researchers have uncovered a new malware strain capable of stealing credentials immediately after gaining a foothold on a victim network, capturing both stored browser passwords and live keystrokes in real time through a standalone stealer and a malicious browser extension. What makes the malware particularly difficult to contain, according to ReliaQuest, is its likely use of AI-generated code and process injection to evade detection tools. It also incorporates a persistence mechanism that can silently re-execute even after an infected host appears fully clean.  DeepLoad Delivery via ClickFix The authors of the malware, which ReliaQuest is tracking as "DeepLoad" are using the ClickFix social engineering technique to distribute the credential stealer in enterprise environments. "DeepLoad steals credentials from the moment it lands, so even partial containment can still leave you with exposed passwords, session, and active accounts," ReliaQuest warned in a report this week. "Before the main attack chain finishes, a standalone credential stealer, filemanager.exe, is already running on its own infrastructure and can exfiltrate data even if the main loader is detected and blocked."  Related:Phishers Pose as Palo Alto Networks' Recruiters for Months in Job Scam In addition, the browser extension that the malware drops and registers can capture credentials in real-time as users type them, and it persists across browser sessions until explicitly removed, the security vendor said. As with most ClickFix scams, the attack chain begins with users receiving fake browser prompts asking them to execute a seemingly benign command to "fix" some kind of made up "error." In this instance, the command immediately creates a scheduled task to re-execute the loader, so it persists across reboots or partial detection, without the user having to do anything thereafter. The malware then uses mshta.exe, a legitimate Windows utility, to communicate with the attacker's infrastructure and download a heavily obfuscated PowerShell loader. Heavily Padded Loader ReliaQuest's analysis of DeepLoad showed its functional code is buried under thousands of lines of junk code that appeared designed to overwhelm static scanning tools and leave them with nothing to flag. The sheer volume of padding in the loader suggests that it was not written by a human author, but most likely developed by an AI model, the security vendor said. DeepLoad's actual attack logic itself is a short decryption routine that unpacks its malicious payload entirely in memory. Once unpacked, the payload is injected into LockAppHost.exe, a legitimate Windows process that manages the lock screen and is something that most security tools do not actively monitor.   Related:Attackers Hide Infostealer in Copyright Infringement Notices To carry out the injection DeepLoad uses a PowerShell feature called Add-Type to generate a temporary Dynamic Link Library (DLL) that is dropped into the compromised computer's Temp directory. ReliaQuest found the malware compiling the DLL freshly on every execution and assigning a randomized filename to ensure that security tools scanning for a specific filename would never find anything to match. The malware also disables PowerShell command history to cover its own tracks. In the campaign that ReliaQuest investigated, DeepLoad also spread to connected USB drives within 10 minutes of initial infection. The security vendor found the malware writing more than 40 files disguised as Chrome setup files, Firefox installers, AnyDesk shortcuts and other familiar installers, to the USB drive of a compromised host.  The goal likely was to maximize the chances of a user clicking on one of the spurious installers and infecting another machine in the process. Even so, it is unclear whether USB propagation is a built-in feature of DeepLoad or if it's something that the attacker layered on for that particular campaign, ReliaQuest said. Related:C2 Implant 'SnappyClient' Targets Crypto Wallets Standard Remediation Not Enough Standard cleanup, like removing scheduled tasks, temporary files, and other indicators of compromise (IOCs) is not enough to fully remediate DeepLoad infections, ReliaQuest said. That's because DeepLoad creates a persistent trigger within Windows Management Instrumentation (WMI) that automatically reruns the attack without any further user interaction. In the incident that ReliQuest investigated, the malware re-executed the attacks a full three days after the affected host had appeared to be fully cleaned. The company recommended that organizations hit by DeepLoad audit and remove WMI event subscriptions on affected hosts before returning them to production. They should also enable PowerShell Script Block Logging and behavioral endpoint monitoring to look for malicious activity since file-based scanning will not detect the loader. In addition, organizations should change all credentials associated with a compromised system, including saved passwords, active session tokens, and accounts that were in use during the infection period. "The indications of AI generation mean there is a realistic probability that obfuscation will evolve from generic noise to padding tailored to the specific environment it's deployed in, making behavioral baselining harder over time," ReliaQuest warned. "As WMI subscriptions are added to remediation checklists, the persistence mechanism is likely to shift to other legitimate Windows features that currently receive less attention." About the Author Jai Vijayan Contributing Writer Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year career at Computerworld, Jai also covered a variety of other technology topics, including big data, Hadoop, Internet of Things, e-voting, and data analytics. Prior to Computerworld, Jai covered technology issues for The Economic Times in Bangalore, India. Jai has a Master's degree in Statistics and lives in Naperville, Ill. Want more Dark Reading stories in your Google search results? ADD US NOW More Insights Industry Reports Frost Radar™: Non-human Identity Solutions 2026 CISO AI Risk Report Cybersecurity Forecast 2026 The ROI of AI in Security ThreatLabz 2025 Ransomware Report Access More Research Webinars Building a Robust SOC in a Post-AI World Retail Security: Protecting Customer Data and Payment Systems Rethinking SSE: When Unified SASE Delivers the Flexibility Enterprises Need Securing Remote and Hybrid Work Forecast: Beyond the VPN AI-Powered Threat Detection: Beyond Traditional Security Models More Webinars You May Also Like CYBERATTACKS & DATA BREACHES Cyberattackers Target LastPass, Top Password Managers by Nate Nelson, Contributing Writer OCT 16, 2025 CYBERATTACKS & DATA BREACHES Zscaler, Palo Alto Networks Breached via Salesloft Drift by Alexander Culafi SEP 02, 2025 CYBERATTACKS & DATA BREACHES After Pahalgam Attack, Hacktivists Unite Under #OpIndia by Nate Nelson, Contributing Writer MAY 09, 2025 CYBERATTACKS & DATA BREACHES DeepSeek Breach Opens Floodgates to Dark Web by Emma Zaballos APR 22, 2025 Editor's Choice CYBERSECURITY OPERATIONS Why Stryker's Outage Is a Disaster Recovery Wake-Up Call byJai Vijayan MAR 12, 2026 5 MIN READ CYBER RISK What Orgs Can Learn From Olympics, World Cup IR Plans byTara Seals MAR 12, 2026 THREAT INTELLIGENCE Commercial Spyware Opponents Fear US Policy Shifting byRob Wright MAR 12, 2026 9 MIN READ Want more Dark Reading stories in your Google search results? 2026 Security Trends & Outlooks THREAT INTELLIGENCE Cybersecurity Predictions for 2026: Navigating the Future of Digital Threats JAN 2, 2026 CYBER RISK Navigating Privacy and Cybersecurity Laws in 2026 Will Prove Difficult JAN 12, 2026 ENDPOINT SECURITY CISOs Face a Tighter Insurance Market in 2026 JAN 5, 2026 THREAT INTELLIGENCE 2026: The Year Agentic AI Becomes the Attack-Surface Poster Child JAN 30, 2026 Download the Collection Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox. SUBSCRIBE Webinars Building a Robust SOC in a Post-AI World THURS, MARCH 19, 2026 AT 1PM EST Retail Security: Protecting Customer Data and Payment Systems THURS, APRIL 2, 2026 AT 1PM EST Rethinking SSE: When Unified SASE Delivers the Flexibility Enterprises Need WED, APRIL 1, 2026 AT 1PM EST Securing Remote and Hybrid Work Forecast: Beyond the VPN TUES, MARCH 10, 2026 AT 1PM EST AI-Powered Threat Detection: Beyond Traditional Security Models WED, MARCH 25, 2026 AT 1PM EST More Webinars White Papers Autonomous Pentesting at Machine Speed, Without False Positives Fixing Organizations' Identity Security Posture Best practices for incident response planning Industry Report: AI, SOC, and Modernizing Cybersecurity The Threat Prevention Buyer's Guide: Find the best AI-driven threat protection solution to stop file-based attacks. Explore More White Papers BLACK HAT ASIA | MARINA BAY SANDS, SINGAPORE Experience cutting-edge cybersecurity insights in this four-day event featuring expert Briefings on the latest research, Arsenal tool demos, a vibrant Business Hall, networking opportunities, and more. Use code DARKREADING for a Free Business Pass or $200 off a Briefings Pass. GET YOUR PASS GISEC GLOBAL 2026 GISEC GLOBAL is the most influential and the largest cybersecurity gathering in the Middle East & Africa, uniting global CISOs, government leaders, technology buyers, and ethical hackers for three power-packed days of innovation, strategy, and live cyber drills. 📌 BOOK YOUR SPACE