CastleLoader Malware Hits 400+ Devices via Cloudflare-Themed ClickFix Phishing Attack

CastleLoader, a sophisticated malware loader, has compromised over 400 devices since its debut in early 2025, with cybersecurity firm PRODAFT reporting 469 infections out of 1,634 attempts by May 2025, achieving a staggering 28.7% success rate.

This modular threat actor leverages advanced phishing techniques, including Cloudflare-themed ClickFix lures and deceptive GitHub repositories, to deploy a arsenal of secondary payloads such as information stealers and remote access trojans (RATs).

Threat Targets U.S. Government Entities

Notably, U.S. government entities have emerged as prime targets, underscoring the malware’s potential for widespread disruption in critical infrastructure sectors.

According to the report, Analysts at PolySwarm have flagged CastleLoader as an emerging high-impact threat, emphasizing its ability to exploit trusted platforms and human vulnerabilities to bypass conventional security measures.

CastleLoader’s attack chain begins with phishing campaigns that mimic legitimate services, often presenting victims with fake error messages or CAPTCHA challenges on domains impersonating Cloudflare, Google Meet, or browser update notifications.

These lures coerce users into copying and executing malicious PowerShell commands through the Windows Run dialog, effectively sidestepping email gateways and relying on user-initiated actions for initial compromise.

In parallel, the malware exploits developers’ trust in open-source ecosystems by distributing tainted installers via counterfeit GitHub repositories, such as those masquerading as SQL Server Management Studio libraries (SSMS-lib).

Once executed, these installers establish connections to command-and-control (C2) servers, enabling the dynamic deployment of payloads tailored to the attacker’s objectives.

Payload Delivery

At its core, CastleLoader employs a blend of PowerShell scripts and AutoIT-compiled executables to achieve persistence and evasion.

Upon activation, the AutoIT component injects shellcode into memory as a dynamic link library (DLL), utilizing hashed DLL names and API resolutions to obscure its operations and connect to one of seven hardened C2 servers.

These servers are administered through a web-based control panel that provides granular telemetry, including victim IP addresses, system fingerprints, and geographic data, allowing operators to orchestrate targeted campaigns with precision.

The panel’s Delivery module manages payload storage with metadata tags, while the Tasks module supports advanced features like geographic filtering, encrypted Docker container deployments, mandatory administrative privilege checks, anti-virtual machine detection routines, and simulated error prompts to deflect suspicion.

The loader’s versatility shines in its payload ecosystem, which includes StealC and RedLine for credential harvesting from browsers and cryptocurrency wallets, DeerStealer for exfiltrating sensitive data, NetSupport RAT and SectopRAT for establishing persistent backdoors, and HijackLoader for chaining additional malware loaders.

Overlaps with DeerStealer operations, where both threats distribute HijackLoader, hint at collaborative threat actor networks, further complicating attribution.

Network communications are routed through legitimate file-sharing services and compromised websites, enhancing resilience against takedowns and enabling stealthy payload retrieval.

This distributed architecture, combined with CastleLoader’s modular design, amplifies its threat profile, making it particularly adept at infiltrating high-value targets like government systems.

With infections spanning multiple sectors and a focus on critical victims, CastleLoader represents a paradigm of modern malware loaders, blending social engineering with technical prowess.

Organizations are urged to bolster defenses against phishing, monitor GitHub dependencies, and implement behavioral analytics to detect anomalous PowerShell executions.

Indicators of Compromise (IOCs)

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!