CastleLoader

Named by 2 kept items in this workspace.

Search every workspace for CastleLoader. It matches the name as written, so it can find other things that share it.

The items that name it 2

Threat Actors Abuse IronPython to Deliver CastleLoader/CastleRAT
writeup2026-09-17
delivered via downloaded IronPython interpreter
ClickFix Removes Your Background but Leaves the Malware
writeup2026-04-30
Malware loader delivered via the ClickFix/BackgroundFix chain; performs reflective PE loading, ReplaceTextW callback hijacking for evasion, ChaCha20-encrypted C2 communications, and dispatches tasks (launch methods) to deploy further payloads such as NetSupportRAT and CastleStealer

All threat actors in this workspace.