Zscaler ThreatLabz identified SloppyRAT, a new malware family likely used in ransomware-related attacks and delivered through a multi-stage ClickFix infection chain. It combines anti-analysis features, EtherHiding-based C2 resolution, certificate pinning, and extensive remote command execution capabilities, while also showing signs of ongoing development and coding flaws. #SloppyRAT #ClickFix #CastleLoader #CastleRAT #EtherHiding

A surge in LummaStealer infections has been observed, driven by social engineering campaigns leveraging the ClickFix technique to deliver the CastleLoader malware.

The threat actor behind the malware-as-a-service (MaaS) framework and loader called CastleLoader has also developed a remote access trojan known as CastleRAT. "Available in both Python and C variants, CastleRAT's core functionality consists of collecting system information, downloading and executing additional payloads, and executing commands via CMD and PowerShell," Recorded Future Insikt Group said. The cybersecurity company is tracking the threat actor behind the malware families as TAG-150.

Jul 24, 2025Ravie LakshmananMalware / Cybercrime Cybersecurity researchers have shed light on a new versatile malware loader called CastleLoader that has been put to use in campaigns distributing various information stealers and remote access trojans (RATs). The activity employs Cloudflare-themed ClickFix phishing attacks and fake GitHub repositories opened under the names of legitimate applications, Swiss cybersecurity company PRODAFT said in a report shared with The Hacker News.

Researchers identify four new GrayBravo CastleLoader activity clusters targeting logistics and hospitality sectors, signaling a growing MaaS ecosystem.

Four threat clusters are leveraging CastleLoader while GrayBravo expands its malware service infrastructure, increasing coordinated attack activity.

We uncovered ClickFix attacks using fake Google and Cloudflare pages to deliver everything from infostealers to a newly discovered malware loader.

ANY.RUN report reveals how the new CastleLoader malware targets US government agencies using stealthy ClickFix tricks and memory-based attacks to bypass security.

Der berüchtigte Information-Stealer Lumma ist zurück und gefährlicher denn je. Trotz einer internationalen Zerschlagungsaktion im Mai 2025 starten die Cyberkriminellen eine neue Angriffswelle. Sie nutzen eine raffinierte Social-Engineering-Methode namens „ClickFix“ und einen neuen Verteilungsmechanismus, den „CastleLoader“. Das Ziel bleibt dasselbe: sensible Daten wie Passwörter, Bankinformationen und Kryptowährungs-Wallets zu stehlen.Sicherheitsunternehmen wie Bitdefender verzeichnen seit Ende 2025 […] The post Lumma Stealer: Neue Angriffswelle mit gefährlicher ClickFix-Taktik appeared first on BornCity.

Trotz internationaler Zerschlagung vor einem Jahr erlebt die berüchtigte Malware ein Comeback. Ein neuer, raffinierter Verteilungsmechanismus namens „CastleLoader“ treibt die Infektionszahlen in die Höhe und stellt Unternehmen vor neue Herausforderungen.Die Erfolge der Strafverfolgung im Kampf gegen Cyberkriminalität erweisen sich oft als kurzlebig. Das zeigt das aktuelle Comeback von Lumma Stealer, einer Malware-as-a-Service-Plattform. Laut einem neuen […] The post Lumma Stealer: Cyber-Schädling kehrt mit neuer Angriffswelle zurück appeared first on BornCity.