CastleLoader

CastleLoader is a loader malware that first emerged in early 2025, designed to distribute various information stealers and remote access trojans (RATs) through Cloudflare-themed ClickFix phishing attacks and fake GitHub repositories. The malware uses PowerShell commands to download and execute secondary payloads including StealC, RedLine, NetSupport RAT, DeerStealer, HijackLoader, and SectopRAT. CastleLoader employs AutoIT scripts to load shellcode into memory and connects to C2 servers for additional payload delivery. The malware has been observed in campaigns targeting government entities and has achieved a 28.7% infection rate among victims who clicked on malicious links.