Loading story…
Researchers reported multiple campaigns tied to the CastleLoader/CastleRAT malware ecosystem, showing operators adopting uncommon runtimes and social-engineering lures to bypass enterprise controls. ThreatDown said attackers used the Deno JavaScript runtime in what it described as the first observed abuse of Deno for malware delivery and evasion, while LevelBlue documented a related ClickFix variant that impersonated LinkedIn and Indeed through typosquatted domains and fake CAPTCHA pages to trick victims into launching malicious commands.
In the ClickFix intrusion chain, attackers abused native Windows tools including finger.exe, curl.exe, tar.exe, and cmd.exe together with portable Python runtimes to stage fileless payloads in memory. The activity culminated in deployment of CastleLoader, a malware-as-a-service framework using RC4- and ChaCha20-protected communications to fetch tasks and follow-on payloads, including a Python-based RAT that profiles victims, weakens TLS validation, communicates over WebSockets, enables interactive shell access, uploads and executes payloads, and maintains persistence with mutex and watchdog mechanisms.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
LevelBlue reported on a May 2026 ClickFix campaign variant that impersonated LinkedIn and Indeed with typosquatted domains and fake CAPTCHA pages to trick users into running a malicious command. The campaign used Windows LOLBins and portable Python runtimes to stage fileless payloads, then deployed CastleLoader and a Python-based RAT.
ThreatDown published research describing a CastleRAT cyberattack as the first observed case abusing the Deno JavaScript runtime to evade enterprise security controls.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported continued activity around **CastleLoader/CastleBot** malware delivery chains alongside a resurgence of **KongTuke**, with both threats relying heavily on social-engineering lures and staged payload delivery. Red Canary said CastleLoader remained active since early 2025 and was commonly delivered through paste-and-run fake CAPTCHA or impersonation websites, while Trend Micro documented KongTuke abusing compromised WordPress sites in **ClickFix**-style infection flows. The campaigns reflect a broader shift toward user-assisted execution, where victims are tricked into launching malicious commands that initiate multi-stage malware retrieval. Technical analysis from IBM and Splunk tied the Castle ecosystem to a **malware-as-a-service** operation and detailed the tooling used after execution, including use of `finger.exe` to fetch batch commands, portable Python interpreters as a bring-your-own-interpreter technique, multilayer-obfuscated Python loaders, **RC4**-encrypted payload retrieval, and process injection into `python.exe`. Splunk's review of **Castle RAT** highlighted the client malware's tactics and ATT&CK-mapped behavior, while Red Canary noted anti-analysis checks, C2-based tasking, and detection opportunities such as repeated caret obfuscation in `cmd.exe` command lines. Together, the reporting shows an active loader-and-RAT ecosystem being distributed through fake verification pages and compromised web infrastructure.
Jul 23, 2026
Multiple research reports detailed **Windows-focused malware delivery chains** that rely on social engineering and abuse of legitimate services to blend into normal enterprise traffic. FortiGuard Labs described a **multi-stage campaign targeting users in Russia** that starts with business-themed decoy documents and scripts, then escalates to security-control bypass and surveillance before deploying **Amnesia RAT** and ultimately **ransomware** with widespread file encryption. A notable technique in that intrusion is the abuse of **Defendnot** (a Windows Security Center trust-model research tool) to **disable Microsoft Defender**, while payloads are hosted modularly across public cloud services (e.g., **GitHub** for scripts and **Dropbox** for binaries) to improve resilience and complicate takedowns. Separately, ReliaQuest reported attackers using **LinkedIn private messages** to build trust with targets and deliver a **WinRAR SFX** that triggers **DLL sideloading** via a legitimate PDF reader, then establishes persistence (Registry `Run` key) and executes **Base64-encoded shellcode in-memory** to load a RAT-like payload. Trend Micro and Koi Security documented **Evelyn Stealer**, which weaponizes **malicious VS Code extensions** to drop a downloader DLL (e.g., `Lightshot.dll`), run hidden PowerShell to fetch `runtime.exe`, and inject the stealer into `grpconv.exe`, exfiltrating data (credentials, cookies, wallets, screenshots, Wi‑Fi credentials) to `server09.mentality[.]cloud` over FTP. AhnLab ASEC also reported **proxyjacking** activity in South Korea attributed to **Larva‑25012**, distributing **proxyware disguised as a Notepad++ installer** and evolving evasion (e.g., injecting into Windows Explorer and using Python-based loaders) to monetize victims’ bandwidth via unauthorized proxyware installation.
Jun 29, 2026
eSentire reported that a June 2026 intrusion against a finance-sector customer began with a **ClickFix-style social engineering lure** that triggered a malicious command, an MSI installer, and a multi-stage malware chain attributed to **TAG-150**. The infection sequence used an apparently AI-generated PowerShell script, `Griffin20.ps1`, to install the **Deno** runtime and launch the Deno-based loader **DinDoor**, which then deployed **DenoRAT** and ultimately **NightshadeC2**. Investigators said the malware communicated with command-and-control infrastructure including `webstizkgao[.]com` and used hard-coded JWTs carrying campaign identifiers such as `buildId 0def066f14754be9` and `buildNote LearnV7msi`. The tooling provided broad post-compromise capability, with **DenoRAT** functioning as a RAT, loader, and stealer that supported command execution, persistence, host fingerprinting, file operations, screenshots, PTY and VNC-style remote control, and theft from browsers and cryptocurrency wallets. eSentire said the malware could also bypass Chromium App-Bound Encryption through **DLL injection**, a technique widely associated with in-memory execution, evasion, and abuse of legitimate Windows processes in ATT&CK `T1055.001`. The final **NightshadeC2** payload was delivered through a PowerShell-driven Python in-memory loader, decrypted from an encrypted container using **AES-256-CBC** with a key derived from `MoscauHighSmoke`, and reflectively mapped into a Python process before the affected host was isolated and remediated.
Jul 17, 2026