ClickFix Lure Delivers CastleLoader, NetSupport RAT and Credential-Stealing Malware
Summary
Huntress details a fake image-background remover campaign that uses ClickFix to deliver CastleLoader, NetSupport RAT and a .NET stealer targeting browser credentials, wallet data and Telegram sessions. The analysis also describes the malware chain and defensive controls
Key points
- Fake BackgroundFix sites imitate image-editing tools; a fake CAPTCHA copies a command to the clipboard and uses finger.exe to retrieve and execute the next stage.
- Huntress identified eight related domains using the same template; the pages also record when visitors reach the paste step.
- The chain downloads Python components and uses shellcode, reflective loading and PEB changes to run CastleLoader.
- CastleLoader can deploy NetSupport RAT for remote access and a custom .NET stealer that collects browser credentials, wallet-extension data and Telegram sessions.
- The stealer fingerprints infected hosts and communicates with its C2 over encrypted traffic; the article also describes its file collection and process-hollowing capabilities.
- Huntress says one CastleLoader launch method appears to fail because it calls misspelled regsrv32.exe rather than regsvr32.exe.
- Suggested defenses include disabling the Run dialog, blocking outbound TCP port 79 where unnecessary, and keeping Chromium browsers updated.
Article Details
- Attack Vectors
- A fake BackgroundFix image-editing page uses a ClickFix prompt to copy a command to the victim's clipboard; the command invokes finger.exe to retrieve and execute attacker-supplied content.
- The retrieved script downloads a Python distribution and further Python payloads, which load shellcode and an embedded PE in memory.
- CastleLoader retrieves tasks from its C2, including NetSupport RAT delivery and APC injection of a .NET payload.
- CastleStealer collects browser credentials, cookies, wallet-extension data, Discord tokens, Telegram session files, and screenshots.
- Defensive Notes
- Disable the Windows Run dialog through Group Policy or the NoRun registry setting to disrupt the ClickFix paste-and-run step.
- Block outbound TCP port 79 where finger traffic is not required; the article identifies finger.exe as the chain's entry point.
- Keep Chromium-family browsers updated: the article says Chrome 127's App-Bound Encryption would impede this build's legacy credential-extraction method.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | ai-scan[.]digital | BackgroundFix landing-page domain identified among the campaign's malicious sites. |
| DOMAIN | background-off[.]com | Related malicious BackgroundFix landing-page domain using the campaign template. |
| DOMAIN | background-ready[.]online | Related malicious BackgroundFix landing-page domain using the campaign template. |
| DOMAIN | backgroundformat[.]online | Related malicious BackgroundFix landing-page domain using the campaign template. |
| DOMAIN | bg-go[.]online | Related malicious BackgroundFix landing-page domain using the campaign template. |
| DOMAIN | bg-ready[.]online | Related malicious BackgroundFix landing-page domain using the campaign template. |
| DOMAIN | bg-removerok[.]online | Related malicious BackgroundFix landing-page domain using the campaign template. |
| DOMAIN | bg-transparency[.]online | Related malicious BackgroundFix landing-page domain using the campaign template. |
| DOMAIN | cheeshomireciple[.]com | Attacker-controlled finger server used to deliver the initial command payload. |
| DOMAIN | giovettiadv[.]com | Domain identified as a NetSupport RAT C2; the article gives port 688. |
| DOMAIN | poronto[.]com | Domain identified as a NetSupport RAT C2; the article gives port 688. |
| IPV4 | 38[.]146[.]28[.]30 | CastleStealer C2 address; the article gives port 22989. |
| SHA256 | bde21d8be65d31e1c380f2daae2f73c79f3e1f4bca70fb990db6fdf6c3768c92 | Hash identified as the CastleLoader Core final v8 payload. |
| SHA256 | ed391a16389234f9ebb6727711baaf3e068d7f77c465708fa3e8b7d0565d7fb9 | Hash identified as the decrypted .NET stealer payload, net40.bin. |
| URL | hxxps[:]//brionter[.]com/4ba0af68-0037-5f6e-afd1-64f89fc0f554/net40[.]bin | URL identified as the CastleStealer payload delivery location. |
| URL | hxxps[:]//obelnamevalf[.]org/OaTS7yE9zd/default | URL identified as the NetSupport RAT package delivery location. |
| URL | hxxps[:]//trindastal[.]com/4ba0af68-0037-5f6e-afd1-64f89fc0f554/loc8 | URL used to fetch the Stage-2 Python downloader. |
| URL | hxxps[:]//trindastal[.]com/4ba0af68-0037-5f6e-afd1-64f89fc0f554/v8 | URL used to download the RC4-encrypted shellcode stage. |
| URL | hxxps[:]//trindastal[.]com/8250d149-9bf8-566d-9d7d-ea925eae0a4c/ | CastleLoader C2 endpoint identified in the article. |
MITRE ATT&CK
T1005 · Data from Local SystemCastleStealer reads local browser databases, wallet-extension files, and Telegram session files.T1027 · Obfuscated Files or InformationPayloads use XOR, RC4, base64, zlib, encrypted strings, and Cyrillic character substitution to obscure content.T1041 · Exfiltration Over C2 ChannelScreenshots and collected host or victim data are sent back through the malware's C2 communications.T1053.005 · Scheduled TaskThe NetSupport task registers the dropped client as a Scheduled Task with a logon trigger.T1055.004 · Asynchronous Procedure CallA CastleLoader task uses launch method 7 for APC injection of a .NET binary into a target process.T1055.012 · Process HollowingCastleStealer includes a process-hollowing primitive targeting powershell.exe.T1059.001 · PowerShellCastleLoader task launch methods 10–12 invoke PowerShell commands or scripts.T1059.003 · Windows Command ShellThe initial command uses cmd.exe syntax and executes content returned by finger.exe.T1105 · Ingress Tool TransferThe chain downloads Python payloads, shellcode, and task payloads from attacker-controlled URLs.T1113 · Screen CaptureCastleLoader tasks and CastleStealer capture desktop screenshots.T1140 · Deobfuscate/Decode Files or InformationThe Python stages decode and decompress payloads, reverse Cyrillic substitutions, and decrypt shellcode.T1204.004 · Malicious Copy and PasteThe victim is prompted to paste and run the malicious clipboard command through the fake BackgroundFix verification flow.T1539 · Steal Web Session CookieThe stealer collects browser cookies and copies Telegram session data that the article says can enable session takeover.T1555.003 · Credentials from Web BrowsersCastleStealer extracts Chromium credentials and cookies from browser data stores, using DPAPI to access the AES master key.T1620 · Reflective Code LoadingAn in-memory reflective PE loader maps the embedded PE, resolves imports, and executes its entry point.
People
Malware
CastleLoaderThe chain delivers CastleLoader, which then drops both NetSupport RAT and a custom .NET stealer (We are calling it "CastleStealer", in the spirit of the franchise).CastleStealerThe chain delivers CastleLoader, which then drops both NetSupport RAT and a custom .NET stealer (We are calling it "CastleStealer", in the spirit of the franchise).NetSupport RATThe chain delivers CastleLoader, which then drops both NetSupport RAT and a custom .NET stealer (We are calling it "CastleStealer", in the spirit of the franchise).
Products
DiscordDiscord is targeted by directory name with the typical Local Storage / leveldb token-grab pattern, and Telegram sessions are stolen wholesale by copying the entire tdata directory.Google ChromeIt walks Local Extension Settings, Sync Extension Settings, and IndexedDB directories for every profile, with special handling for chrome-extension_* and _0.indexeddb.leveldb paths (that's the wallet-extension grab).Microsoft WindowsThe XOR-decoded helper string in the binary actually spells regsrv32.exe - s and v swapped on a Windows binary that's been shipping since the 90s.PowerShellPowerShell shenanigansPythonThe second resolves to a filename like <N><M>.exe where each N/M is cmd's %RANDOM% (0-32767), so every infection renames the Python binary to something unique, for example 29693877.exe.TelegramNetSupport gives the operator hands-on remote access; CastleStealer grabs browser credentials, wallet extension data, and Telegram session files.