ClickFix Campaign Uses Finger Protocol and Python to Deliver CastleLoader and RAT
Summary
LevelBlue describes a ClickFix campaign using fake job-site CAPTCHA pages and the Finger protocol to stage CastleLoader and a Python RAT through fileless execution and encrypted C2.
Key points
- The campaign uses typosquatted pages impersonating LinkedIn and Indeed, where a fake CAPTCHA prompts users to paste and run a clipboard command.
- The infection chain abuses Windows utilities, including finger.exe, curl.exe, and tar.exe, and deploys portable Python runtimes.
- Python scripts use layered obfuscation and Windows APIs to execute shellcode in memory before loading CastleLoader.
- CastleLoader retrieves configuration and tasks from C2 servers; its communications use ChaCha20, with RC4 used for staged payloads.
- The final Python RAT supports interactive command-shell access, file and payload delivery, in-memory execution, and watchdog-style persistence.
- The analysis recommends blocking outbound TCP port 79, restricting portable runtimes, monitoring LOLBin and fileless execution, and training users to recognize ClickFix lures.
Article Details
- Attack Vectors
- Typosquatted phishing pages impersonate LinkedIn and Indeed and use fake CAPTCHA prompts to initiate a ClickFix infection chain.
- The lure copies an obfuscated command to the clipboard and prompts the user to press Enter; the command uses the Finger protocol through native Windows utilities to retrieve and execute command output.
- The campaign uses renamed copies of legitimate curl.exe binaries and portable Python runtimes to retrieve and run later stages.
- Python scripts use multiple obfuscation layers and ctypes to execute shellcode in memory, leading to CastleLoader.
- CastleLoader retrieves tasks and additional payloads over encrypted C2 communications, then delivers a Python-based RAT.
- The RAT uses WebSocket C2 for interactive shell control, payload delivery, in-memory execution, and watchdog-style relaunch behavior.
- Defensive Notes
- Train users to recognize ClickFix lures, fake CAPTCHA prompts, phishing, SEO poisoning, and typosquatting.
- Disable the Windows Run dialog (Win+R) to reduce exposure to attacks that trick users into pasting and executing commands.
- Block outbound TCP port 79 at network egress, as recommended in the article for limiting Finger protocol abuse.
- Restrict portable and interpreted runtimes, including Python, in non-standard or user-writable paths, and use application control to limit native Windows utility abuse.
- Monitor for LOLBin abuse and fileless execution patterns, and investigate unusual native-utility invocations and in-memory execution.
- Deploy EDR to improve endpoint visibility and detect multi-stage execution chains.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | crewlcrewlcrewl[.]com | Domain listed in the article's Python RAT C2 domain indicators. |
| DOMAIN | crewlworkinew[.]com | Domain listed in the article's Python RAT C2 domain indicators. |
| DOMAIN | kevinnotanother[.]com | Hardcoded C2 domain in the Python-based RAT configuration. |
| DOMAIN | novayastaruxa[.]com | Domain listed in the article's Python RAT C2 domain indicators. |
| DOMAIN | staruxaproruha[.]com | Domain listed in the article's Python RAT C2 domain indicators. |
| SHA256 | 08a474368a2f94f347ad9e1a0a08d4258fcf49c6b9373214f7901bb770bacca4 | SHA-256 hash identified for the Python loader scr7. |
| SHA256 | 0e346fb46176ffce4c7dbe40a8682bc1f4a2fc70b7389be427568d97a47bd149 | SHA-256 hash identified for Python RAT bytecode main.pyc. |
| SHA256 | 7c54bcf3aea8348e8902cac80eb0df31b43a71601a62e2514087fef40a416bfd | SHA-256 hash identified for Python RAT bytecode play.pyc. |
| SHA256 | c024a3d852b73fef5bfca7ec5c80df3d59ff9ec858e0adad80c588fe22c39dfc | SHA-256 hash identified for RC4-encrypted shellcode variant v6. |
| SHA256 | cd4a51037bf58733c0cb24b273951dd3fcea45a2aaeb8b30a3c625e183c4c0c7 | SHA-256 hash identified for Stage 1 shellcode variant t6. |
| SHA256 | d04ae4d214531d70c634d29763a9c0b84d601cf94aaca4720363f7512995393c | SHA-256 hash listed for a campaign shellcode or loader artifact. |
| SHA256 | d3e936fa36289fd1210047d8f25257bab0608825ed92908dc98c00e33bdb3db2 | SHA-256 hash identified for the Python loader scr11. |
| SHA256 | d56b810dfacaa1630bf562ccdefd46835349710d9516334e1a182619335ddea7 | SHA-256 hash identified for Stage 1 shellcode variant t3. |
| SHA256 | e5e43b0830369c39fab45363486da4d21a98c5097ea262c9816997f11c73c1c4 | SHA-256 hash identified for CastleLoader variant kevin. |
| SHA256 | eca03a7a2af5d410d65efb095cca22ccd94cf17a04caf41d808ec5bcecfde0b5 | SHA-256 hash listed among campaign shellcode, loader, and payload artifacts. |
| SHA256 | ee2d34ac98eaf1451d19fdc99f0bb52db1db60f71933a91f5655af0703ff2464 | SHA-256 hash identified for CastleLoader variant CrewlPiton. |
| URL | hxxps[:]//ai-like[.]net/95126aeb-4120-56b1-8c9e-63fdf0c0b6f9 | CastleLoader endpoint listed as campaign infrastructure. |
| URL | hxxps[:]//candipoker[.]net/ebd417db-979c-51f8-aedf-88a2bf8aa6c3 | CastleLoader endpoint listed as campaign infrastructure. |
| URL | hxxps[:]//catalyst-ltd[.]net/95126aeb-4120-56b1-8c9e-63fdf0c0b6f9 | CastleLoader endpoint listed as campaign infrastructure. |
| URL | hxxps[:]//dapala[.]net/95126aeb-4120-56b1-8c9e-63fdf0c0b6f9 | CastleLoader endpoint listed as campaign infrastructure. |
| URL | hxxps[:]//dmtn-tv[.]net/95126aeb-4120-56b1-8c9e-63fdf0c0b6f9 | CastleLoader endpoint listed as campaign infrastructure. |
| URL | hxxps[:]//domawe[.]net/95126aeb-4120-56b1-8c9e-63fdf0c0b6f9 | CastleLoader endpoint listed as campaign infrastructure. |
| URL | hxxps[:]//idrci[.]net/95126aeb-4120-56b1-8c9e-63fdf0c0b6f9 | CastleLoader endpoint listed as campaign infrastructure. |
| URL | hxxps[:]//indeed-jobs[.]net/leyts.php | Phishing and payload-staging endpoint identified in the campaign's indicator list. |
| URL | hxxps[:]//linked-on[.]com/leyts.php | Phishing and payload-staging endpoint identified in the campaign's indicator list. |
| URL | hxxps[:]//linkedall[.]org/infos.php | Phishing landing-page URL identified in the campaign's indicator list. |
| URL | hxxps[:]//sedaliarealty[.]net/1ed3c2fc-f870-5522-a6bd-71c0a4d78ddd | URL in CastleLoader's decoded configuration, identified as a C2 URL. |
| URL | hxxps[:]//sedaliarealty[.]net/ebd417db-979c-51f8-aedf-88a2bf8aa6c3 | CastleLoader endpoint listed as campaign infrastructure. |
| URL | hxxps[:]//sinjim[.]net/95126aeb-4120-56b1-8c9e-63fdf0c0b6f9 | CastleLoader endpoint listed as campaign infrastructure. |
| URL | hxxps[:]//uslinked[.]org/infos.php | Phishing landing-page URL identified in the campaign's indicator list. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe campaign uses caret obfuscation, ROT13, Cyrillic substitution, Base64, XOR, RC4, and ChaCha-based encryption.T1036 · MasqueradingThe campaign impersonates legitimate platforms and disguises renamed curl.exe and Python binaries and paths.T1059.003 · Windows Command ShellThe infection chain invokes cmd.exe to execute obfuscated commands and Finger command output.T1059.006 · PythonPython runtimes and scripts decode and execute later-stage payloads, including shellcode and RAT bytecode.T1059.007 · JavaScriptEmbedded JavaScript retrieves remote content, decodes it with ROT13, and injects it into the page DOM.T1071.001 · Web ProtocolsPayload retrieval and C2 use HTTPS requests, HTTP POST requests, and WebSocket-over-HTTPS communications.T1082 · System Information DiscoveryThe malware collects host details including OS, hostname, domain, architecture, installed AV products, and elevation state.T1105 · Ingress Tool TransferThe campaign downloads Python runtimes, shellcode, CastleLoader stages, and additional payloads from remote infrastructure.T1106 · Native APIThe malware uses Windows APIs through ctypes and WinHTTP APIs for execution and WebSocket communications.T1113 · Screen CaptureCastleLoader can capture the desktop using the GDI BitBlt pipeline.T1204.001 · Malicious LinkThe infection chain requires user interaction with a fake CAPTCHA and execution of the command copied to the clipboard.T1497.001 · System ChecksCastleLoader runs the CPUID instruction to check for VMware, VirtualBox, and Parallels environments.T1566.002 · Spearphishing LinkVictims are lured through phishing URLs on typosquatted pages impersonating LinkedIn and Indeed.T1573.001 · Symmetric CryptographyCastleLoader encrypts C2 communications with ChaCha, and the campaign uses RC4 to decrypt staged payloads.
Malware
Products
Cloudflare TurnstileFakeCaptcha Cloudflare Turnstile page impersonating LinkedIn.CPythonThis directory is also created under %LocalAppData% and mimics a legitimate Python installation structure, depending on the runtime variant being used (embedded CPython or IronPython):IndeedLevelBlue’s CTI team analyzed a new ClickFix campaign that uses typosquatted LinkedIn and Indeed pages, the Finger protocol, and legitimate Windows utilities to deliver CastleLoader and a Python-based RAT.IronPython%LocalAppData%python-3.15.0a1-embed-win32.pdf, and %LocalAppData%IronPython.3.4.2.pdfLinkedInLevelBlue’s CTI team analyzed a new ClickFix campaign that uses typosquatted LinkedIn and Indeed pages, the Finger protocol, and legitimate Windows utilities to deliver CastleLoader and a Python-based RAT.Microsoft WindowsLevelBlue’s CTI team analyzed a new ClickFix campaign that uses typosquatted LinkedIn and Indeed pages, the Finger protocol, and legitimate Windows utilities to deliver CastleLoader and a Python-based RAT.