ClickFix Social Engineering Sparks Rise of CastleLoader Attacks

A newly observed CastleLoader campaign leverages ClickFix social-engineering prompts to get victims to run a command that launches a hidden conhost.exe to fetch a tar archive, unpack a Python interpreter in AppData, and execute compiled Python bytecode that reconstructs and runs CastleLoader shellcode entirely in memory. The chain replaces prior AutoIt droppers with a compact Python loader; uses PEB Walking, hashed DLL/API identifiers, and XOR decryption of staged payloads; and exhibits network markers (notably the GoogeBot user agent and a known staging path) consistent with prior CastleLoader activity. Blackpoint recommends user education, restricting Run dialog and scripting interpreters, monitoring LOLBin sequences, DNS tracking, and watching for Python binaries from atypical locations.