Tag: castleloader

10 Attack Reports | 0 Vulnerabilities

Attack reports

ClickFix Is Now Hiring: From Job Platform Impersonation to Python-Based RAT Delivery

A multi-stage phishing campaign emerged in early May 2026, impersonating LinkedIn and Indeed through typosquatted domains to deliver malicious payloads. The attack chain begins with fake CAPTCHA pages distributed via Google Ads, leveraging the legacy Finger protocol and native Windows utilities. Vi…

social engineering

fileless execution

Published: June 4, 2026

Downloadable IOCs: 31

ClickFix Removes Your Background but Leaves the Malware

BackgroundFix masquerades as a free image-editing tool but functions as a ClickFix social engineering lure. The fake service prompts users to verify they are human, copying malicious commands to their clipboard that invoke finger.exe to retrieve additional payloads. This chain delivers CastleLoader…

social engineering

reflective loader

Published: April 30, 2026

Downloadable IOCs: 9

DinDoor Backdoor: Deno Runtime Abuse and 20 Active C2 Servers

DinDoor is a Deno-based backdoor delivered via MSI files that exploits the Deno runtime to execute obfuscated JavaScript for command and control communications and system fingerprinting. Two analyzed samples show different execution behaviors: one writes JavaScript to disk while the other executes …

tsundere botnet

Published: April 23, 2026

Downloadable IOCs: 20

Iranian MOIS Actors & the Cyber Crime Connection

Iranian intelligence services are increasingly engaging with the cyber crime ecosystem, leveraging criminal tools, services, and operational models to support state objectives. This trend is particularly evident among actors linked to the Ministry of Intelligence and Security (MOIS), such as Void M…

tsundere botnet

Published: March 10, 2026

Downloadable IOCs: 14

CastleLoader Malware Analysis: Full Execution Breakdown

CastleLoader is a sophisticated malware loader designed to deliver and install malicious components, primarily targeting government entities and critical infrastructure. It employs a multi-stage execution chain involving Inno Setup, AutoIt, and process hollowing to evade detection. The loader deliv…

credential theft

process hollowing

Published: January 15, 2026

Downloadable IOCs: 6

Snakes in the Castle: Inside the Walls of Python-Driven CastleLoader Delivery

The Blackpoint SOC recently responded to an incident initiated through the tried-and-true ClickFix technique; a social engineering method consistently leveraged across numerous campaigns this past year. These lures convince users to press Win + R to open the Windows Run dialog box, then enter a com…

Published: December 15, 2025

Downloadable IOCs: 6

CastleLoader Activity Clusters Target Multiple Industries

Insikt Group has identified four distinct activity clusters associated with GrayBravo's CastleLoader malware, each with unique tactics and victim profiles. This supports the assessment that GrayBravo operates a malware-as-a-service model. One cluster, TAG-160, impersonates logistics firms and uses …

malware-as-a-service

Published: December 9, 2025

Downloadable IOCs: 87

Malicious Infrastructure Finds Stability with aurologic GmbH

German hosting provider aurologic GmbH has become a central hub for high-risk hosting networks, providing upstream transit to multiple threat activity enablers. These include sanctioned entities like Aeza Group and other providers associated with cybercrime and disinformation campaigns. aurologic's…

rhadamanthys stealer

redline stealer

risepro stealer

dark crystal rat

destiny stealer

Published: November 6, 2025

Downloadable IOCs: 23

Deconstructing a Cyber Deception: An Analysis of the Clickfix HijackLoader Phishing Campaign

This analysis delves into the HijackLoader malware campaign, which has gained prominence since 2023 for its sophisticated payload delivery and evasion techniques. The campaign initiates with a CAPTCHA-based phishing attack, progressing through multiple stages of obfuscated PowerShell scripts. It em…

Published: September 12, 2025

Downloadable IOCs: 14

CastleLoader Analysis

CastleLoader, a versatile malware loader, has infected 469 devices since May 2025 using Cloudflare-themed ClickFix phishing and fake GitHub repositories. It delivers information stealers and RATs, with a 28.7% infection rate. The malware employs sophisticated techniques, including PowerShell and Au…

information stealers

payload delivery

u.s. government

Published: August 13, 2025

Downloadable IOCs: 0

Click here to see more Attack Reports