Stealthy CastleLoader Malware Attacking US Government Agencies and Critical Infrastructure

CastleLoader is a stealthy, multi-stage malware loader observed in early 2025 that has been used to compromise ~460 organizations — including U.S. government agencies and critical infrastructure — by delivering secondary payloads (info-stealers and RATs) directly into memory. The campaign uses social-engineering lures (a 'ClickFix' fake-update vector) and an Inno Setup/AutoIt installer to launch a suspended jsc.exe process, then performs advanced process hollowing and memory injection to evade disk- and signature-based detection, enabling persistent, hard-to-detect footholds.