Microsoft’s disruption of the malware-signing-as-a-service provider Fox Tempest has forced the operators of the Lorem Ipsum shellcode loader and backdoor to change tactics.
Previously, the campaign relied on Trojanized Microsoft Teams installers that were signed with fraudulently obtained Microsoft Trusted Signing certificates. After Microsoft dismantled Fox Tempest’s infrastructure and revoked more than 1,000 abused certificates, the old delivery model became much harder to sustain.
Rather than stopping, the operators quickly pivoted.
According to BlueVoyant, the threat actors behind Lorem Ipsum are now using ClickFix lures hosted on compromised WordPress websites to trick users into running malicious PowerShell commands.
The change shows how quickly modern threat actors can adapt when one delivery channel is disrupted.
What Is Lorem Ipsum?
Lorem Ipsum is a multistage shellcode loader and backdoor campaign tracked by BlueVoyant since February 2026.
The malware gives attackers an initial foothold on victim systems and can support further post-exploitation activity.
Earlier versions of the campaign used fake Microsoft Teams installers promoted through SEO poisoning and malvertising. Victims searching for Teams downloads could land on malicious portals and download what looked like a legitimate installer.
Because the installers were signed with valid Microsoft Trusted Signing certificates, they appeared more trustworthy to users and some security controls.
That trust layer was central to the campaign’s success.
Fox Tempest Disruption Changed the Delivery Model
Fox Tempest, also known as Forging Marauder, provided malware-signing-as-a-service capabilities.
By fraudulently obtaining Microsoft Trusted Signing certificates, Fox Tempest enabled malware operators to distribute signed malicious installers that appeared legitimate.
Microsoft’s takedown of Fox Tempest removed a key part of Lorem Ipsum’s delivery chain.
Without access to a reliable supply of trusted certificates, the operators could no longer depend on signed Trojanized installers as their primary delivery method.
BlueVoyant assessed that this forced the operators to adopt a mechanism that does not require code signing at all.
That mechanism is ClickFix.
What Is ClickFix?
ClickFix is a social engineering technique that tricks users into copying and pasting a malicious command into a terminal or PowerShell window.
The lure usually pretends that the user must perform a quick manual step to fix a browser issue, complete a security update, verify access, or resolve a technical problem.
In this campaign, compromised WordPress sites display fake browser update messages.
The page claims the user’s browser is out of date and provides what appears to be a Microsoft Edge security intelligence update command.
The user is instructed to paste the command into Windows Terminal.
If they do, the command silently downloads and executes the Lorem Ipsum malware in the background while showing a fake success message that says the browser was updated successfully.
This is dangerous because the user becomes the execution mechanism.
Compromised WordPress Sites Used as Delivery Infrastructure
BlueVoyant observed Lorem Ipsum operators using at least five legitimate but compromised WordPress websites to host ClickFix lures.
The affected sites span multiple sectors, including:
- architecture
- legal services
- construction technology
When users visit one of these compromised websites, an injected iframe displays the fake browser update prompt.
This significantly broadens the potential victim pool.
The previous delivery model depended on users searching for Microsoft Teams downloads and landing on SEO-poisoned or malicious download portals. The new model can target anyone browsing a compromised WordPress site.
That makes the campaign more opportunistic and potentially more scalable.
From Fake Teams Installers to Fake Browser Updates
The original Lorem Ipsum campaign relied on a familiar attack pattern:
- SEO poisoning or malvertising leads users to a fake download portal.
- The user downloads a Trojanized Microsoft Teams installer.
- The installer is signed with a valid Microsoft Trusted Signing certificate.
- Running the installer deploys the Lorem Ipsum loader and backdoor.
The new attack pattern is different:
- A user visits a compromised WordPress website.
- A fake browser update prompt appears.
- The page instructs the user to paste a PowerShell command.
- The command downloads and executes the malware.
- A fake success message reassures the user.
The attacker no longer needs a signed binary at the first step.
Instead, the campaign relies on user trust, urgency, and technical confusion.
Why This Pivot Is More Dangerous
The pivot to ClickFix may actually increase the campaign’s reach.
Signed fake installers require attackers to maintain fake download portals, attract search traffic, and preserve signing capability.
ClickFix reduces those dependencies.
With ClickFix, attackers only need compromised websites and convincing social engineering. They can turn legitimate websites into malware delivery points without needing to sign payloads up front.
The approach also bypasses some traditional assumptions.
Users may believe they are completing a normal browser update. Security tools may see PowerShell execution, but if the command is obfuscated or staged through changing infrastructure, static detection becomes less reliable.
The campaign, therefore, shifts the burden toward behavioral detection.
Technical Features of Lorem Ipsum
BlueVoyant’s analysis describes Lorem Ipsum as a sophisticated multistage infection chain.
The campaign has used:
- DLL side-loading
- encrypted payloads
- shellcode loading
- backdoor functionality
- unique victim identifiers
- dead-drop C2 retrieval
- abuse of legitimate web platforms
One notable technique involved abusing the legitimate Indian blogging platform LetsDiskuss as a dead drop to retrieve command-and-control server addresses.
Dead-drop resolvers make infrastructure harder to disrupt because the malware does not need to hardcode a fixed C2 address. Instead, it can retrieve updated connection details from a third-party platform.
This adds resilience and complicates detection.
Possible Link to Rapid Brigantine
BlueVoyant initially assessed Lorem Ipsum as a rapidly maturing malware campaign likely operated by a midtier initial access broker.
The company has since revised that assessment and now strongly believes the campaign is linked to Rapid Brigantine, a financially motivated cybercriminal group also tracked as:
- Vanilla Tempest
- DEV-0832
- Vice Society
Rapid Brigantine has been active since at least mid-2022 and has been associated with multiple ransomware families, including:
- Rhysida
- BlackCat
- Zeppelin
- Quantum Locker
This possible connection matters because it suggests Lorem Ipsum may not be a standalone malware operation. It may be part of a broader ransomware access pipeline.
Why the Rapid Brigantine Link Matters
If Lorem Ipsum is connected to Rapid Brigantine, defenders should treat infections as potentially serious initial access events.
The goal may not be limited to deploying a backdoor.
Possible follow-on activity could include:
- credential theft
- lateral movement
- data exfiltration
- ransomware deployment
- persistence creation
- privilege escalation
- remote access tooling
- discovery of high-value systems
That changes the response priority.
A detected Lorem Ipsum infection should not be treated as a minor malware cleanup. It should trigger a broader investigation into post-exploitation activity.
Threat Actor Resilience After Disruption
The Lorem Ipsum campaign is a strong example of attacker resilience.
Microsoft’s disruption of Fox Tempest removed a key enabler: signed malware delivery.
But the operators did not disappear. They adjusted their delivery method within days.
This shows that takedowns can disrupt threat actors, but rarely eliminate the broader operation unless follow-on infrastructure, credentials, affiliates, and monetization paths are also addressed.
Modern cybercriminal groups often have multiple delivery options ready or can quickly build new ones.
The loss of one channel may simply push them to another.
Why Static Indicators Are Not Enough
BlueVoyant emphasized that defenders should prioritize behavioral detections over static indicators.
That is because Lorem Ipsum operators have shown they can quickly change:
- delivery methods
- lure themes
- hosting infrastructure
- compromised websites
- payload staging
- command formats
- C2 resolution paths
Static indicators such as hashes, domains, or file names are still useful, but they may expire quickly.
Behavioral patterns are more durable.
For example, defenders should monitor for:
- PowerShell commands pasted from browsers
- downloads launched from terminal commands
- suspicious iframe injections on WordPress sites
- fake browser update prompts
- unexpected DLL side-loading
- encrypted payload staging
- unusual outbound C2 retrieval
- abnormal process trees following browser activity
- user-initiated terminal execution after web browsing
The delivery mechanism may change, but many post-exploitation behaviors remain consistent.
Defensive Recommendations
Organizations should adapt defenses to ClickFix-style attacks and fast-changing malware delivery.
Recommended controls include:
- educate users never to paste commands from websites into PowerShell or Terminal
- block or warn on suspicious PowerShell command patterns
- monitor browser-to-terminal execution chains
- restrict PowerShell where possible
- enable script block logging
- use endpoint detection for LOLBin and shellcode loader behavior
- inspect compromised WordPress referrals
- block known malicious ClickFix infrastructure
- monitor for fake browser update prompts
- detect DLL side-loading activity
- restrict execution from temporary and download directories
- monitor for unexpected outbound connections after PowerShell execution
- treat Lorem Ipsum detections as potential ransomware precursor activity
User awareness is especially important because ClickFix depends on convincing the user to run the command voluntarily.
Recommendations for Website Owners
Because the new delivery model abuses compromised WordPress sites, website owners also have a role.
WordPress administrators should:
- keep WordPress core updated
- update all plugins and themes
- remove unused plugins
- enforce MFA for admin accounts
- review administrator users
- scan for malicious iframe injections
- monitor file integrity
- use web application firewall rules
- restrict write permissions
- review suspicious JavaScript changes
- clean compromised sites immediately
A compromised website can become part of a malware delivery network even if the site owner is not directly targeted.
Lessons From the Campaign
The Lorem Ipsum campaign highlights several important lessons.
First, malware signing disruptions can force attackers to pivot, but not necessarily stop them.
Second, ClickFix remains effective because it abuses human trust rather than software vulnerability.
Third, compromised legitimate websites can become powerful malware delivery infrastructure.
Fourth, malware campaigns linked to ransomware ecosystems should be treated as high-risk.
Fifth, defenses must focus on behavior across multiple delivery paths, not only known indicators or specific malware samples.
Final Thoughts
Microsoft’s disruption of Fox Tempest removed a major malware-signing pipeline, but the operators behind Lorem Ipsum quickly adapted.
By moving from signed fake Microsoft Teams installers to ClickFix lures on compromised WordPress websites, the campaign eliminated its dependence on code signing and expanded the pool of potential victims.
The shift shows how resilient modern malware operations have become.
The lesson is clear: do not build detection only around one delivery method. Watch for the behaviors that remain consistent across campaigns, especially suspicious PowerShell execution, fake update prompts, DLL side-loading, and post-exploitation activity linked to ransomware operators.
Threat actors adapt quickly. Defensive visibility must adapt faster.
