Malware

Scarlet Goldfinch

Scarlet Goldfinch is a threat activity cluster associated with compromised websites that socially engineer users into executing malicious code. It has been characterized as using a distribution scheme similar to SocGholish, commonly relying on paste-and-run or fake CAPTCHA-style lures that trick victims into launching attacker-supplied commands. The cluster has been observed using JScript-based stages to drop NetSupport Manager onto victim systems, functioning primarily as a delivery mechanism for follow-on remote access tooling rather than as a standalone payload family. Scarlet Goldfinch has been tracked as a prevalent threat in 2025 and 2026 and has been described as a dropper-oriented cluster within broader “color bird” threat reporting. High-confidence observations support Windows-focused delivery via compromised websites and user-executed script content.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

5 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

3 techniques

T1059.001PowerShellEvidence1

In most scenarios, once users interact with the Fix or Verify button in the lure, the button will covertly copy an obfuscated PowerShell command to the clipboard and present the user with “verification steps.”

T1059.007JavaScriptEvidence1

Using cscript.exe to execute a command containing //e:Jscript in this way gives us a detection opportunity. Detection opportunity: Instances of wscript.exe or cscript.exe to run/interpret malicious JScript payloads

T1204User ExecutionEvidence2

often using fake CAPTCHA lures to trick users into executing code via malicious copy and paste (aka paste and run, ClickFix, fakeCAPTCHA)

Collection

1 technique

T1115Clipboard DataEvidence1

the button will covertly copy an obfuscated PowerShell command to the clipboard and present the user with “verification steps.”

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

By following the “verification steps,” the user inadvertently runs the command and additional commands will reach out and download malware or tools.

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

red canary blogNews

Aug 20, 2026

Intelligence Insights: August 2026 | Red Canary

An activity cluster involving compromised websites used to trick users into executing malicious code.

red canary threat reportNews

Feb 12, 2026

Malicious Copy and Paste | Red Canary Threat Detection Report

Named threat/tool delivered via paste-and-run campaigns.

red canary blogNews

Nov 20, 2025

Intelligence Insights: October 2025

Activity cluster using JScript files to drop NetSupport Manager, similar to SocGholish distribution schemes.

red canary blogNews

Aug 5, 2025

Ranking the top threats and ATT&CK techniques for the first half of 2025 | Red Canary

A Red Canary-named color bird threat described as a dropper.

+1 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping5

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Scarlet Goldfinch