Potemkin loader delivering EtherRAT and RMMProject in memory
Malware Activity
Summary
Hide ▲
Show ▼
The Potemkin loader is delivering EtherRAT and RMMProject to Windows systems, giving operators in-memory payload execution and browser credential theft. The loader uses a DGA to reach C2 and reflectively loads follow-on modules, limiting on-disk visibility. The payload set expands control to remote screen access, screenshot capture, and credential collection, increasing post-compromise risk.
Related Happenings
ClickFix multi-loader delivery campaign targeting Windows and macOS users
Campaign
H score34
First: 16.06.2026 20:41
Last: 16.06.2026 20:41
Sources 1
How related:
Cybersecurity researchers have flagged multiple ClickFix campaigns that deliver three malware loaders called BabaDeda Loader, Lorem Ipsum Loader, and Potemkin, per independent reports from Morphisec, BlueVoyant, and Huntress, respectively.
About this happening:
The ClickFix malware-delivery campaign is spreading BabaDeda Loader, Lorem Ipsum Loader, and Potemkin, widening risk for Windows and macOS users across several...
ClickFix multi-loader delivery campaign targeting Windows and macOS users
CampaignHow related: Cybersecurity researchers have flagged multiple ClickFix campaigns that deliver three malware loaders called BabaDeda Loader, Lorem Ipsum Loader, and Potemkin, per independent reports from Morphisec, BlueVoyant, and Huntress, respectively.
About this happening: The ClickFix malware-delivery campaign is spreading BabaDeda Loader, Lorem Ipsum Loader, and Potemkin, widening risk for Windows and macOS users across several...
LummaStealer infection surge via CastleLoader
Malware Activity
H score30
First: 11.02.2026 19:02
Last: 11.02.2026 19:02
Sources 1
About this happening:
The LummaStealer infostealer operation now includes a widespread ClickFix campaign observed in February 2026 that abuses Windows Terminal (wt.exe) instead of the R...
LummaStealer infection surge via CastleLoader
Malware ActivityAbout this happening: The LummaStealer infostealer operation now includes a widespread ClickFix campaign observed in February 2026 that abuses Windows Terminal (wt.exe) instead of the R...
Latest development: 06.03.2026 08:44
Microsoft disclosed a widespread ClickFix social-engineering campaign that uses Windows Terminal (wt.exe) instead of the Windows Run dialog to trick users into launching malicious commands, then chains through Terminal, PowerShell, cmd.exe, and MSBuild.exe to download payloads, set persistence via scheduled tasks, configure Microsoft Defender exclusions, and inject Lumma Stealer into chrome.exe and msedge.exe with QueueUserAPC().
DEAD#VAX campaign using IPFS-hosted VHD phishing to deploy AsyncRAT
Campaign
H score33
First: 04.02.2026 19:24
Last: 04.02.2026 19:24
Sources 1
About this happening:
The DEAD#VAX campaign is using phishing-delivered IPFS-hosted VHD files to deploy AsyncRAT, creating a stealthier path to fileless endpoint compromise. The chain r...
DEAD#VAX campaign using IPFS-hosted VHD phishing to deploy AsyncRAT
CampaignAbout this happening: The DEAD#VAX campaign is using phishing-delivered IPFS-hosted VHD files to deploy AsyncRAT, creating a stealthier path to fileless endpoint compromise. The chain r...
GachiLoader kidkadi.node adds VEH-based PE injection for in-memory payload swapping
Technical Analysis
H score6
First: 19.12.2025 17:34
Last: 19.12.2025 17:34
Sources 1
About this happening:
A new GachiLoader variant uses kidkadi.node to perform PE injection through Vectored Exception Handling, creating an in-memory swapping technique that raises detec...
GachiLoader kidkadi.node adds VEH-based PE injection for in-memory payload swapping
Technical AnalysisAbout this happening: A new GachiLoader variant uses kidkadi.node to perform PE injection through Vectored Exception Handling, creating an in-memory swapping technique that raises detec...
ClickFix variants delivering LummaC2 and Rhadamanthys
Malware Activity
H score29
First: 24.11.2025 22:42
Last: 24.11.2025 22:42
Sources 1
About this happening:
Since October 1, ClickFix variants have been using a fake Windows Update screen and human verification lures to trick Windows users into pasting commands that exec...
ClickFix variants delivering LummaC2 and Rhadamanthys
Malware ActivityAbout this happening: Since October 1, ClickFix variants have been using a fake Windows Update screen and human verification lures to trick Windows users into pasting commands that exec...
Timeline
-
16.06.2026 20:41 2 articles · 29d ago
Potemkin loader uses in-memory execution to deliver EtherRAT and RMMProject on Windows
Technical Analysis UpdateHuntress identified Potemkin as a custom x64 loader that uses a domain generation algorithm to reach C2 and reflectively loads follow-on modules in memory. The loader serves as a conduit for EtherRAT and RMMProject, expanding the campaign to include remote screen control, browser credential theft, screenshot capture, browser autofill collection, and other post-compromise actions on Windows hosts.
Show sources
- ClickFix Campaigns Expand Malware Delivery With New Loaders and Fake Update Lures — thehackernews.com — 16.06.2026 20:41
- ClickFix Campaigns Expand Malware Delivery With New Loaders and Fake Update Lures — thehackernews.com — 16.06.2026 20:41