Cybersecurity researchers have identified multiple active ClickFix campaigns delivering newly documented malware loaders (BabaDeda Loader, Lorem Ipsum Loader, and Potemkin) highlighting the continued effectiveness and evolution of ClickFix social engineering attacks. The campaigns rely on deceptive prompts that trick users into executing malicious PowerShell commands, ultimately deploying information stealers, RATs, and ransomware-related tooling. BabaDeda Loader, linked to the long-running BabaDeda crypter service, targets education and financial organizations using stealth techniques such as in-memory shellcode execution, DLL side-loading, and externally stored payloads to deliver stealers and backdoors capable of extensive data theft and remote control. Separately, compromised WordPress sites are being used to distribute Lorem Ipsum Loader, which has been attributed with high confidence to the financially motivated threat actor Vanilla Tempest (also known as Rapid Brigantine/Vice Society) and serves as a precursor to ransomware deployments including Rhysida. A third campaign leverages the Potemkin loader to deploy EtherRAT and RMMProject, enabling browser credential theft, remote access, lateral movement, and persistent access through tools such as Cloudflare Tunnel and Chisel. Researchers note that these campaigns illustrate a broader trend toward modular malware ecosystems that separate delivery, storage, execution, and payload deployment, while underscoring the enduring success of ClickFix as an initial access technique that exploits user trust rather than software vulnerabilities.