Skip to content
Threat Feed
Subscribe

Tag

Loader

3 briefs RSS
high threat

CL-CRI-1171 Pay-Per-Install Infrastructure and Malware Campaign

The CL-CRI-1171 threat actor operates a large-scale pay-per-install marketplace, leveraging SEO poisoning and YouTube gaming lures to deploy a persistent multi-payload loader used to distribute malware including Insomnia RAT and ARKTunnel.

WinDirStat CL-CRI-1171 ppi malware seo-poisoning loader remote-access-trojan c2
1r 2t 5i
high advisory

CastleLoader Malware Loader and ClearFake Activity in July 2026

Red Canary reports heightened activity of the CastleLoader malware loader, which uses paste-and-run techniques and legitimate tools to deliver infostealers and RATs, alongside continued prevalence of the ClearFake activity cluster in June 2026.

malware loader infostealer remote-access-trojan paste-and-run drive-by download windows
3r 7t 7i
high advisory

The TTF Trap: Global Phishing Campaign Leverages Obfuscated JScript and Lua Loaders for RATs and Infostealers

FortiGuard Labs identified a global phishing campaign employing obfuscated JScript, disguised TrueType Font (.ttf) files, and Lua loaders to deliver remote access Trojans (RATs) and infostealers to victims.

phishing loader jscript lua rat infostealer malware
7t