Cybersecurity researchers have make clear a brand new versatile malware loader referred to as CastleLoader that has been put to make use of in campaigns distributing numerous info stealers and distant entry trojans (RATs).
The exercise employs Cloudflare-themed ClickFix phishing assaults and pretend GitHub repositories opened beneath the names of reliable functions, Swiss cybersecurity firm PRODAFT mentioned in a report shared with The Hacker Information.
The malware loader, first noticed within the wild earlier this yr, has been used to distribute DeerStealer, RedLine, StealC, NetSupport RAT, SectopRAT, and even different loaders like Hijack Loader.
“It employs useless code injection and packing strategies to hinder evaluation,” the corporate mentioned. “After unpacking itself at runtime, it connects to a C2 (command-and-control) server, downloads goal modules, and executes them.”
CastleLoader’s modular construction permits it to behave as each a supply mechanism and a staging utility, enabling menace actors to separate preliminary an infection from payload deployment. This separation complicates attribution and response as a result of it decouples the an infection vector from the eventual malware habits, giving attackers extra flexibility in adapting campaigns over time.
CastleLoader payloads are distributed as transportable executables containing an embedded shellcode, which then invokes the primary module of the loader that, in flip, connects to the C2 server as a way to fetch and execute the next-stage malware.
Assaults distributing the malware have relied on the prevalent ClickFix method on domains posing as software program growth libraries, videoconferencing platforms, browser replace notifications, or doc verification methods, finally tricking customers into copying and executing PowerShell instructions that activate the an infection chain.
Victims are directed to the bogus domains via Google searches, at which level they’re served pages containing faux error messages and CAPTCHA verification bins developed by the menace actors, asking them to hold out a sequence of directions to supposedly handle the problem.
Alternatively, CastleLoader leverages faux GitHub repositories mimicking reliable instruments as a distribution vector, inflicting customers who unknowingly obtain them to compromise their machines with malware as an alternative.
“This method exploits builders’ belief in GitHub and their tendency to run set up instructions from repositories that seem respected,” PRODAFT mentioned.
This strategic abuse of social engineering mirrors strategies utilized in preliminary entry brokers (IABs), underscoring its position inside a broader cybercrime provide chain.
PRODAFT mentioned it has noticed Hijack Loader being delivered through DeerStealer in addition to CastleLoader, with the latter additionally propagating DeerStealer variants. This implies the overlapping nature of those campaigns, regardless of them being orchestrated by totally different menace actors.
Since Could 2025, CastleLoader campaigns have leveraged seven distinct C2 servers, with over 1,634 an infection makes an attempt recorded through the time interval. Evaluation of its C2 infrastructure and its web-based panel—which is used to supervise and handle the infections – exhibits that as many as 469 units have been compromised, leading to an an infection price of 28.7%.
Researchers additionally noticed components of anti-sandboxing and obfuscation—options typical in superior loaders like SmokeLoader or IceID. Mixed with PowerShell abuse, GitHub impersonation, and dynamic unpacking, CastleLoader displays a rising pattern in stealth-first malware loaders that function as stagers in malware-as-a-service (MaaS) ecosystems.
“Fortress Loader is a brand new and energetic menace, quickly adopted by numerous malicious campaigns to deploy an array of different loaders and stealers,” PRODAFT mentioned. “Its subtle anti-analysis strategies and multi-stage an infection course of spotlight its effectiveness as a main distribution mechanism within the present menace panorama.”
“The C2 panel demonstrates operational capabilities sometimes related to malware-as-a-service (MaaS) choices, suggesting the operators have expertise in cybercriminal infrastructure growth.”
