Red Canary Intelligence Insights July 2026: ClearFake Leads Third Straight Month Amid CastleLoader Debut and Caret-Obfuscated Paste-and-Run Campaigns

Red Canary Intelligence Insights July 2026 (TL-2026-1658), also tracked as Intelligence Insights July 2026, is a medium-severity malware campaign, first published 2026-07-23. It is attributed to GrayBravo with medium confidence, affects Microsoft Windows (all supported desktop versions, including 11 24H2), maps to 24 MITRE ATT&CK techniques (T1027, T1053, T1055), and is covered by 9 detection rules and 41 indicators of compromise.

Key facts for TL-2026-1658

Threat ID
TL-2026-1658
Also known as
Intelligence Insights July 2026
Severity
MEDIUM
Status
ACTIVE
Category
MALWARE
First published
2026-07-23
Last reviewed
2026-07-23
Attribution
GrayBravo
Attribution confidence
MEDIUM
Motivation
FINANCIAL
Target sectors
technology, professional services, job seekers employment platforms, general enterprise, government administration, finance, health
Target regions
North America, Europe, Global
Detection rules
9
Indicators of compromise
41

Malware and tooling in Red Canary Intelligence Insights July 2026

Malware and tooling: ACR Stealer, Atomic Stealer, CASTLELOADER, ClearFake, KongTuke, MacSync Stealer, Mistic, Netsupport Manager, NightshadeC2 (Windows), Scarlet Goldfinch, SectopRAT, Vidar

Red Canary's June 2026 threat prevalence ranking shows ClearFake retaining the #1 spot for a third consecutive month via fake-CAPTCHA ClickFix (T1204.004) drive-by lures now backed by EtherHiding BSC-testnet smart-contract C2, while KongTuke (WordPress-abusing ClickFix/CrashFix TDS) surged and TAG-150's CastleLoader debuted in the top 10, delivering NetSupport Manager, CastleRAT (Python/PyNightshade and C variants), and undisclosed .NET infostealers. Adversaries are converging on caret-character CLI obfuscation, Bring-Your-Own-Interpreter (portable CPython/IronPython) execution, and triple-layer Base64/zlib/UTF-32-with-Cyrillic-substitution encoding to defeat static and command-line detection.

How Red Canary Intelligence Insights July 2026 works

Red Canary's July 2026 Intelligence Insights report (covering June 2026 telemetry) confirms ClearFake as the most prevalent threat observed across customer environments for a third consecutive month. ClearFake is a JavaScript injection cluster that compromises legitimate WordPress sites to serve fake CAPTCHA / fake browser-update overlays that trick victims into pasting and executing attacker-supplied commands (ClickFix / T1204.004 Malicious Copy and Paste). In 2026 ClearFake operators (tracked historically to Storm-1607/Storm-0426/Storm-0249 infrastructure and the TA571-linked ClearFake compromise group) have adopted EtherHiding, storing payload-routing JavaScript directly inside immutable BNB Smart Chain (BSC) testnet smart contracts, making the delivery infrastructure effectively takedown-resistant. Confirmed final-stage payloads from the EtherHiding chain include SectopRAT (.NET browser-hijacking RAT) and ACRStealer (C++ infostealer), delivered via OS-aware branching for Windows and macOS victims.

KongTuke (aka Chaya_002 / LandUpdate808 / TAG-124), ranked #2 and showing a significant June 2026 activity increase, is a traffic distribution system that injects malicious JavaScript into compromised WordPress installations to serve ClickFix-family lures — FakeCAPTCHA, FileFix, and the newer CrashFix variant, which uses a malicious Chrome extension masquerading as an ad blocker to intentionally crash the browser and coerce the victim into running a fraudulent "security scan" command. KongTuke traffic has been linked to delivery of LummaC2, MintsLoader, D3F@ck Loader, Mocha Manakin, WARMCOOKIE, the new Mistic backdoor, Python-based modeloRAT, and downstream Rhysida/Interlock ransomware deployment.

CastleLoader, debuting in the top 10 at rank #5, is a malware-as-a-service (MaaS) loader operated by TAG-150 (Recorded Future Insikt Group attribution), active since at least March 2025 and first documented by PRODAFT in July 2025 (also tracked as CastleBot). Distribution is primarily via Cloudflare-themed ClickFix phishing pages and fraudulent GitHub repositories impersonating legitimate applications, plus SEO-poisoned fake download portals and a BackgroundFix campaign (April 2026) using fake background-image-removal utility sites. The infection chain begins with caret-obfuscated (^) command strings invoking the living-off-the-land binary finger.exe against an attacker-controlled TCP/79 daemon (Signed Binary Proxy Execution) to retrieve a Bring-Your-Own-Interpreter (BYOI) stage: a portable, unmodified CPython or IronPython interpreter renamed to a random numeric filename, deployed alongside a Base64/zlib-compressed Python script. That script is wrapped in an additional UTF-32 encoding layer with Cyrillic-character substitution before being RC4-decrypted and shellcode-injected into python.exe/pythonw.exe, executing entirely in memory. The resulting five-stage kill chain (clipboard execution -> shellcode stager with PEB-walking/DJB2 API hashing -> PE loader using direct NtAllocateVirtualMemory calls and PEB_LDR_DATA manipulation to evade EDR hooks, including an NtManageHotPatch hook for Windows 11 24H2 -> ChaCha20-encrypted core backdoor) culminates in delivery of CastleRAT (Python variant aka PyNightshade/NightshadeC2, and a more capable C variant with keylogging, screenshot capture, and cryptocurrency-clipper functionality), NetSupport Manager RAT, and previously reported payloads including DeerStealer, RedLine, StealC, SectopRAT, MonsterV2, and WARMCOOKIE. C2 uses a four-tier architecture (victim-facing servers, tiered VPS relays, backup servers) with Steam Community profiles used as dead-drop resolvers pointing to real C2 infrastructure, and IP-API geolocation lookups used for victim targeting.

Across all three clusters, Red Canary highlights a converging evasion toolkit: caret-character (^) obfuscation of cmd.exe strings to defeat literal-string detections, BYOI execution using portable interpreters to avoid file-based AV signatures on system Python installs, and multi-layer Base64/zlib/UTF-32 encoding with Cyrillic substitution to break naive Base64/string-matching detections. Red Canary's published detection opportunity targets command-processor invocations containing multiple caret characters used to obfuscate CLI strings, plus explorer.exe spawning cmd.exe with 'start'/'exit' arguments characteristic of paste-and-run lures.

MITRE ATT&CK techniques used in TL-2026-1658

Defense Evasion

T1027 Obfuscated Files or Information; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1497 Virtualization/Sandbox Evasion; T1620 Reflective Code Loading

Persistence

T1053 Scheduled Task/Job

Privilege Escalation

T1055 Process Injection; T1548 Abuse Elevation Control Mechanism

Collection

T1056 Input Capture; T1113 Screen Capture; T1115 Clipboard Data

Execution

T1059 Command and Scripting Interpreter; T1106 Native API; T1204 User Execution

Command and Control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1568 Dynamic Resolution; T1571 Non-Standard Port; T1573 Encrypted Channel

Discovery

T1082 System Information Discovery; T1497 Virtualization/Sandbox Evasion

Initial Access

T1189 Drive-by Compromise; T1566 Phishing

Impact

T1486 Data Encrypted for Impact

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in Red Canary Intelligence Insights July 2026

  • Microsoft — Windows (all supported desktop versions, including 11 24H2)
    Vulnerable versions: all
  • WordPress — WordPress CMS (compromised/vulnerable plugin installations)
    Vulnerable versions: various outdated plugins/themes

Remediation for Red Canary Intelligence Insights July 2026

Immediate actions

  • Block outbound TCP/79 (finger protocol) at the network egress boundary; finger.exe is not a legitimate business dependency for most environments
  • Detect and alert on cmd.exe/PowerShell command lines containing multiple caret (^) characters used for string obfuscation
  • Detect explorer.exe spawning cmd.exe with 'start' and 'exit' arguments consistent with ClickFix/paste-and-run lures
  • Block known ClearFake/KongTuke/CastleLoader C2 domains and the programsbookss[.]com C2 domain at DNS/proxy layer
  • Disable clipboard-to-Run-dialog muscle memory via user awareness training on ClickFix/CAPTCHA lures

Workarounds

  • Disable the Windows 'finger' client (finger.exe) via AppLocker/WDAC where not required
  • Restrict Run-dialog (Win+R) clipboard paste via GPO in high-risk environments as a stopgap against ClickFix

Longer-term hardening

  • Deploy EDR with behavioral detection for reflective code loading, PEB_LDR_DATA manipulation, and direct NtAllocateVirtualMemory calls bypassing VirtualAlloc hooks
  • Monitor for unsigned/portable Python interpreters (CPython/IronPython) executing from user-writable paths (%APPDATA%, %TEMP%)
  • Implement application allowlisting to block execution of renamed/portable interpreter binaries
  • Monitor DNS/HTTP traffic to blockchain RPC endpoints (BSC/Ethereum) from browser processes for EtherHiding-style smart-contract C2 retrieval
  • Restrict or monitor WordPress admin access and plugin/theme file integrity to reduce KongTuke's compromised-site pipeline

Weaknesses (CWE) in Red Canary Intelligence Insights July 2026

CWE-506

Timeline of Red Canary Intelligence Insights July 2026

  • TAG-150 begins development of CastleRAT and associated CastleLoader infrastructure per Recorded Future Insikt Group attribution.
  • PRODAFT first documents CastleLoader (aka CastleBot) as a distinct malware-as-a-service loader family.
  • IBM X-Force identifies CastleLoader distributing MonsterV2 and WARMCOOKIE payloads.
  • TAG-150 CastleRAT Python (PyNightshade/NightshadeC2) and C variants publicly reported by The Hacker News / Recorded Future.
  • KongTuke actors introduce the CrashFix ClickFix variant using a fake ad-blocker Chrome extension to crash browsers and coerce victims into running fraudulent 'security scan' commands.
  • ClickFix campaigns spread the MacSync macOS infostealer via fake AI tool installers, expanding ClickFix's cross-platform reach.
  • CastleLoader's BackgroundFix campaign launches, using fake image-background-removal websites (ai-scan[.]digital, bg-transparency[.]online) as ClickFix lures.
  • Trend Micro and Darktrace report ClearFake operators storing payload-routing JavaScript inside BNB Smart Chain testnet smart contracts (EtherHiding), delivering SectopRAT and ACRStealer via OS-aware branching.
  • New Mistic backdoor reported as linked to KongTuke ClickFix and Python-based ModeloRAT campaigns; KongTuke shows a significant June 2026 activity increase per Red Canary telemetry.
  • Red Canary publishes Intelligence Insights: July 2026, ranking ClearFake #1 for a third consecutive month, KongTuke #2, and CastleLoader debuting at #5 in June 2026 customer telemetry.
  • Threat ingested and researched into the Threadlinqs Intelligence Platform from the Red Canary Blog RSS feed.

Sources cited for Red Canary Intelligence Insights July 2026

Threats related to Red Canary Intelligence Insights July 2026

Detection coverage for TL-2026-1658

As of 2026-07-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1658 across Splunk SPL, Microsoft KQL and Sigma, covering 41 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats