LummaStealer infections surge after CastleLoader malware campaigns

Bitdefender reports a significant resurgence of the LummaStealer infostealer between December 2025 and January 2026, now widely delivered via the CastleLoader malware loader and ClickFix social-engineering campaigns; CastleLoader is a heavily obfuscated AutoIT/Python in-memory loader that performs sandbox checks, uses multiple persistence techniques, intentionally triggers a failed DNS lookup (a detectable artifact), and fetches and executes LummaStealer and other infostealers distributed through trojanized installers, pirated software, and fake verification pages that trick users into running malicious PowerShell commands.