Executive Summary
The CastleStealer campaign represents an evolving threat that combines sophisticated information theft with remote access capabilities. Initially identified in April 2026, the campaign has transitioned from Python-based scripts to high-fidelity 'ClickFix' social engineering lures, such as fake 'BackgroundFix' image editors and malicious Google ads for Node.js. These lures trick victims into executing commands that initiate a multi-stage infection chain.
Technically, the attack utilizes CastleLoader to drop both NetSupport RAT and a custom .NET information stealer dubbed CastleStealer. Recent iterations have added significant capabilities, including the ability to bypass Chromium's App-Bound Encryption using the IElevator COM interface and the implementation of a remote shell for post-infection command execution. The malware employs stealthy communication methods, such as small encrypted TCP packets and the abuse of the legacy Windows 'finger' utility for initial payload delivery.
This threat is particularly dangerous because it bridges the gap between simple credential theft and full interactive endpoint compromise. The ability to exfiltrate browser data, crypto-wallets, and messaging sessions while maintaining a remote shell allows operators to rapidly escalate their presence within a network. The campaign's use of legitimate cloud services for hosting and its sophisticated evasion techniques, like process hollowing into PowerShell, demand proactive defensive measures.