Cybersecurity researchers have make clear a brand new versatile malware loader referred to as CastleLoader that has been put to make use of in campaigns distributing varied info stealers and distant entry trojans (RATs).
The exercise employs Cloudflare-themed ClickFix phishing assaults and faux GitHub repositories opened below the names of professional purposes, Swiss cybersecurity firm PRODAFT stated in a report shared with The Hacker Information.
The malware loader, first noticed within the wild earlier this yr, has been used to distribute DeerStealer, RedLine, StealC, NetSupport RAT, SectopRAT, and even different loaders like Hijack Loader.
“It employs useless code injection and packing strategies to hinder evaluation,” the corporate stated. “After unpacking itself at runtime, it connects to a C2 (command-and-control) server, downloads goal modules, and executes them.”
CastleLoader’s modular construction permits it to behave as each a supply mechanism and a staging utility, enabling risk actors to separate preliminary an infection from payload deployment. This separation complicates attribution and response as a result of it decouples the an infection vector from the eventual malware conduct, giving attackers extra flexibility in adapting campaigns over time.
CastleLoader payloads are distributed as moveable executables containing an embedded shellcode, which then invokes the principle module of the loader that, in flip, connects to the C2 server to be able to fetch and execute the next-stage malware.
Assaults distributing the malware have relied on the prevalent ClickFix method on domains posing as software program improvement libraries, videoconferencing platforms, browser replace notifications, or doc verification techniques, in the end tricking customers into copying and executing PowerShell instructions that activate the an infection chain.
Victims are directed to the bogus domains via Google searches, at which level they’re served pages containing faux error messages and CAPTCHA verification containers developed by the risk actors, asking them to hold out a sequence of directions to supposedly deal with the problem.
Alternatively, CastleLoader leverages faux GitHub repositories mimicking professional instruments as a distribution vector, inflicting customers who unknowingly obtain them to compromise their machines with malware as a substitute.
“This method exploits builders’ belief in GitHub and their tendency to run set up instructions from repositories that seem respected,” PRODAFT stated.
This strategic abuse of social engineering mirrors strategies utilized in preliminary entry brokers (IABs), underscoring its function inside a broader cybercrime provide chain.
PRODAFT stated it has noticed Hijack Loader being delivered by way of DeerStealer in addition to CastleLoader, with the latter additionally propagating DeerStealer variants. This implies the overlapping nature of those campaigns, regardless of them being orchestrated by totally different risk actors.
Since Might 2025, CastleLoader campaigns have leveraged seven distinct C2 servers, with over 1,634 an infection makes an attempt recorded throughout the time interval. Evaluation of its C2 infrastructure and its web-based panel—which is used to supervise and handle the infections – reveals that as many as 469 gadgets had been compromised, leading to an an infection charge of 28.7%.
Researchers additionally noticed parts of anti-sandboxing and obfuscation—options typical in superior loaders like SmokeLoader or IceID. Mixed with PowerShell abuse, GitHub impersonation, and dynamic unpacking, CastleLoader displays a rising development in stealth-first malware loaders that function as stagers in malware-as-a-service (MaaS) ecosystems.
“Citadel Loader is a brand new and lively risk, quickly adopted by varied malicious campaigns to deploy an array of different loaders and stealers,” PRODAFT stated. “Its subtle anti-analysis strategies and multi-stage an infection course of spotlight its effectiveness as a major distribution mechanism within the present risk panorama.”
“The C2 panel demonstrates operational capabilities sometimes related to malware-as-a-service (MaaS) choices, suggesting the operators have expertise in cybercriminal infrastructure improvement.”
