Skip to navigation

Threat reportMalwareTL-2026-1658

Red Canary Intelligence Insights July 2026: ClearFake Leads Third Straight Month Amid CastleLoader Debut and Caret-Obfuscated Paste-and-Run Campaigns

mediumACTIVE

Red Canary's June 2026 threat prevalence ranking shows ClearFake retaining the #1 spot for a third consecutive month via fake-CAPTCHA ClickFix (T1204.004) drive-by lures now backed by EtherHiding BSC-testnet smart-contract C2, while KongTuke (WordPress-abusing ClickFix/CrashFix TDS) surged and TAG-150's CastleLoader debuted in the top 10, delivering NetSupport Manager, CastleRAT (Python/PyNightshade and C variants), and undisclosed .NET infostealers.

Key facts for ClearFake Red Canary July ranking

IdentifiersTL-2026-1658
Also known asIntelligence Insights July 2026
SeverityMEDIUM
Exploitation statusExploited in the wild
Affected productsMicrosoft Windows (all supported desktop versions, including 11 24H2); WordPress WordPress CMS (compromised/vulnerable plugin installations)
Weaknesses (CWE)CWE-506
AttributionGrayBravo (medium confidence)
MalwareACR Stealer, Atomic Stealer, CASTLELOADER, ClearFake, KongTuke, MacSync Stealer, Mistic, Netsupport Manager, NightshadeC2 (Windows), Scarlet Goldfinch, SectopRAT, Vidar
MITRE ATT&CK techniquesT1027 Obfuscated Files or Information, T1053 Scheduled Task/Job, T1055 Process Injection, T1056 Input Capture, T1059 Command and Scripting Interpreter, T1071 Application Layer Protocol, T1082 System Information Discovery, T1105 Ingress Tool Transfer, T1106 Native API, T1113 Screen Capture, T1115 Clipboard Data, T1140 Deobfuscate/Decode Files or Information and 12 more in the attack flow
MotivationFINANCIAL
Target sectorstechnology, professional services, job seekers employment platforms, general enterprise, government administration, finance, health
Target regionsNorth America, Europe, Global
Detection rules9 (1 shown free)
Sources15 cited sources

Detection coverage for ClearFake Red Canary July ranking

As of 2026-07-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1658 across Splunk SPL, Microsoft KQL and Sigma, covering 41 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Caret-Obfuscated Command Line — CastleLoader/ClickFix Paste-and-Run Exploitation

Detects cmd.exe/PowerShell command lines containing 3+ caret (^) characters used to defeat literal-string detection, consistent with CastleLoader/TAG-150 ClickFix tradecraft (e.g. f^i^n^g^e^r nrLeDHDESi@cheeshomireciple.com), and explorer.exe spawning cmd.exe with 'start'/'exit' arguments characteristic of clipboard paste-and-run lures.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1204.004, T1027, T1218
  • Data sources: sysmon, windows_security
  • Severity: high
  • Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\cmd.exe" OR Image="*\\powershell.exe")
| eval caret_count=mvcount(split(CommandLine, "^"))-1
| where caret_count>=3 OR (ParentImage="*\\explorer.exe" AND Image="*\\cmd.exe" AND like(CommandLine, "%start%") AND like(CommandLine, "%exit%"))
| table _time, ComputerName, User, ParentImage, Image, CommandLine, caret_count
| sort -_time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("cmd.exe", "powershell.exe")
| extend caret_count = array_length(split(ProcessCommandLine, "^")) - 1
| where caret_count >= 3 or (InitiatingProcessFileName =~ "explorer.exe" and FileName =~ "cmd.exe" and ProcessCommandLine has "start" and ProcessCommandLine has "exit")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, caret_count
| order by Timestamp desc

Sigma

title: Caret-Obfuscated Command Line or Explorer ClickFix Paste-and-Run (CastleLoader)
id: e1a4c9d2-2f6b-4e3a-9c1d-1a2b3c4d5e6f
status: experimental
description: Detects cmd.exe/PowerShell command lines with 3+ caret characters used as string-obfuscation evasion, or explorer.exe spawning cmd.exe with start/exit arguments consistent with ClickFix paste-and-run lures (ClearFake/KongTuke/CastleLoader).
references:
    - https://redcanary.com/blog/threat-intelligence/intelligence-insights-july-2026/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-23
tags:
    - attack.defense-evasion
    - attack.execution
    - attack.t1027
    - attack.t1204.004
    - attack.tool.castleloader
logsource:
    category: process_creation
    product: windows
detection:
    selection_caret:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|re: '(\^.){3,}'
    selection_clickfix:
        ParentImage|endswith: '\explorer.exe'
        Image|endswith: '\cmd.exe'
        CommandLine|contains|all:
            - 'start'
            - 'exit'
    condition: selection_caret or selection_clickfix
    falsepositives:
        - Legitimate scripts using carets for line continuation in batch files
        - Admin tooling that spawns cmd.exe from Explorer for benign start/exit usage
    level: high

Known false positives:

  • Legitimate batch scripts using carets for multi-line command continuation
  • IT admin scripts spawning cmd.exe from Explorer for benign automation

Tuning notes: Tune caret_count threshold per environment baseline; exclude known packaging/deployment tools (SCCM, Intune scripts) that legitimately use carets. Correlate with parent process explorer.exe for higher-fidelity ClickFix detection.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Portable/Renamed Python Interpreter Executing from User-Writable Path — BYOI Post-Exploitation Stage · unlock with TL Creds
  • Mismatched-Extension Archive Drop and Reinfection Marker — CastleLoader Post-Exploitation Artifacts · unlock with TL Creds
  • Process Hollowing / Reflective Code Loading into python.exe via Direct NtAllocateVirtualMemory — CastleRAT Post-Exploitation Injection · unlock with TL Creds
  • WordPress-Injected KongTuke TDS JavaScript Naming Pattern — C2/Beacon Detection · unlock with TL Creds
  • EtherHiding Blockchain RPC C2 Retrieval from Browser Process — ClearFake Smart-Contract C2 · unlock with TL Creds
  • CastleLoader/CastleRAT Task-Tasking C2 URI and Steam Dead-Drop Resolver Beacon — C2 Lateral Movement · unlock with TL Creds
  • finger.exe LOLBin [indicator] Stage Retrieval — CastleLoader Signed Binary Proxy Execution · unlock with TL Creds
  • explorer.exe → cmd.exe → finger.exe Process Lineage — CastleLoader Initial Exploitation Chain · unlock with TL Creds

Indicators of compromise for ClearFake Red Canary July ranking

As of 2026-07-23, Threadlinqs Intelligence tracks 41 indicators of compromise for TL-2026-1658.

Sample indicators (3 of 41)

  • Domain: programsbookss[.]com
  • Domain: ai-scan[.]digital
  • Domain: bg-transparency[.]online

Defanged, TLP:CLEAR. Full set of 41 indicators: unlock with TL Creds.

41 indicators of compromise · unlock with TL Creds. Compare plans

How ClearFake Red Canary July ranking works

Adversaries are converging on caret-character CLI obfuscation, Bring-Your-Own-Interpreter (portable CPython/IronPython) execution, and triple-layer Base64/zlib/UTF-32-with-Cyrillic-substitution encoding to defeat static and command-line detection.

Red Canary's July 2026 Intelligence Insights report (covering June 2026 telemetry) confirms ClearFake as the most prevalent threat observed across customer environments for a third consecutive month. ClearFake is a JavaScript injection cluster that compromises legitimate WordPress sites to serve fake CAPTCHA / fake browser-update overlays that trick victims into pasting and executing attacker-supplied commands (ClickFix / T1204.004 Malicious Copy and Paste). In 2026 ClearFake operators (tracked historically to Storm-1607/Storm-0426/Storm-0249 infrastructure and the TA571-linked ClearFake compromise group) have adopted EtherHiding, storing payload-routing JavaScript directly inside immutable BNB Smart Chain (BSC) testnet smart contracts, making the delivery infrastructure effectively takedown-resistant. Confirmed final-stage payloads from the EtherHiding chain include SectopRAT (.NET browser-hijacking RAT) and ACRStealer (C++ infostealer), delivered via OS-aware branching for Windows and macOS victims.

KongTuke (aka Chaya_002 / LandUpdate808 / TAG-124), ranked #2 and showing a significant June 2026 activity increase, is a traffic distribution system that injects malicious JavaScript into compromised WordPress installations to serve ClickFix-family lures — FakeCAPTCHA, FileFix, and the newer CrashFix variant, which uses a malicious Chrome extension masquerading as an ad blocker to intentionally crash the browser and coerce the victim into running a fraudulent "security scan" command. KongTuke traffic has been linked to delivery of LummaC2, MintsLoader, D3F@ck Loader, Mocha Manakin, WARMCOOKIE, the new Mistic backdoor, Python-based modeloRAT, and downstream Rhysida/Interlock ransomware deployment.

CastleLoader, debuting in the top 10 at rank #5, is a malware-as-a-service (MaaS) loader operated by TAG-150 (Recorded Future Insikt Group attribution), active since at least March 2025 and first documented by PRODAFT in July 2025 (also tracked as CastleBot). Distribution is primarily via Cloudflare-themed ClickFix phishing pages and fraudulent GitHub repositories impersonating legitimate applications, plus SEO-poisoned fake download portals and a BackgroundFix campaign (April 2026) using fake background-image-removal utility sites. The infection chain begins with caret-obfuscated (^) command strings invoking the living-off-the-land binary finger.exe against an attacker-controlled TCP/79 daemon (Signed Binary Proxy Execution) to retrieve a Bring-Your-Own-Interpreter (BYOI) stage: a portable, unmodified CPython or IronPython interpreter renamed to a random numeric filename, deployed alongside a Base64/zlib-compressed Python script. That script is wrapped in an additional UTF-32 encoding layer with Cyrillic-character substitution before being RC4-decrypted and shellcode-injected into python.exe/pythonw.exe, executing entirely in memory. The resulting five-stage kill chain (clipboard execution -> shellcode stager with PEB-walking/DJB2 API hashing -> PE loader using direct NtAllocateVirtualMemory calls and PEB_LDR_DATA manipulation to evade EDR hooks, including an NtManageHotPatch hook for Windows 11 24H2 -> ChaCha20-encrypted core backdoor) culminates in delivery of CastleRAT (Python variant aka PyNightshade/NightshadeC2, and a more capable C variant with keylogging, screenshot capture, and cryptocurrency-clipper functionality), NetSupport Manager RAT, and previously reported payloads including DeerStealer, RedLine, StealC, SectopRAT, MonsterV2, and WARMCOOKIE. C2 uses a four-tier architecture (victim-facing servers, tiered VPS relays, backup servers) with Steam Community profiles used as dead-drop resolvers pointing to real C2 infrastructure, and IP-API geolocation lookups used for victim targeting.

Across all three clusters, Red Canary highlights a converging evasion toolkit: caret-character (^) obfuscation of cmd.exe strings to defeat literal-string detections, BYOI execution using portable interpreters to avoid file-based AV signatures on system Python installs, and multi-layer Base64/zlib/UTF-32 encoding with Cyrillic substitution to break naive Base64/string-matching detections. Red Canary's published detection opportunity targets command-processor invocations containing multiple caret characters used to obfuscate CLI strings, plus explorer.exe spawning cmd.exe with 'start'/'exit' arguments characteristic of paste-and-run lures.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1497 Virtualization/Sandbox Evasion; T1620 Reflective Code Loading

Persistence

T1053 Scheduled Task/Job

Privilege Escalation

T1055 Process Injection; T1548 Abuse Elevation Control Mechanism

Collection

T1056 Input Capture; T1113 Screen Capture; T1115 Clipboard Data

Execution

T1059 Command and Scripting Interpreter; T1106 Native API; T1204 User Execution

Command and Control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1568 Dynamic Resolution; T1571 Non-Standard Port; T1573 Encrypted Channel

Discovery

T1082 System Information Discovery; T1497 Virtualization/Sandbox Evasion

Initial Access

T1189 Drive-by Compromise; T1566 Phishing

Impact

T1486 Data Encrypted for Impact

defense-impairment

T1685 Disable or Modify Tools

Remediation for ClearFake Red Canary July ranking

Immediate actions

  • Block outbound TCP/79 (finger protocol) at the network egress boundary; finger.exe is not a legitimate business dependency for most environments
  • Detect and alert on cmd.exe/PowerShell command lines containing multiple caret (^) characters used for string obfuscation
  • Detect explorer.exe spawning cmd.exe with 'start' and 'exit' arguments consistent with ClickFix/paste-and-run lures
  • Block known ClearFake/KongTuke/CastleLoader C2 domains and the programsbookss[.]com C2 domain at DNS/proxy layer
  • Disable clipboard-to-Run-dialog muscle memory via user awareness training on ClickFix/CAPTCHA lures

Workarounds

  • Disable the Windows 'finger' client (finger.exe) via AppLocker/WDAC where not required
  • Restrict Run-dialog (Win+R) clipboard paste via GPO in high-risk environments as a stopgap against ClickFix

Longer-term hardening

  • Deploy EDR with behavioral detection for reflective code loading, PEB_LDR_DATA manipulation, and direct NtAllocateVirtualMemory calls bypassing VirtualAlloc hooks
  • Monitor for unsigned/portable Python interpreters (CPython/IronPython) executing from user-writable paths (%APPDATA%, %TEMP%)
  • Implement application allowlisting to block execution of renamed/portable interpreter binaries
  • Monitor DNS/HTTP traffic to blockchain RPC endpoints (BSC/Ethereum) from browser processes for EtherHiding-style smart-contract C2 retrieval
  • Restrict or monitor WordPress admin access and plugin/theme file integrity to reduce KongTuke's compromised-site pipeline

Affected and fixed versions

  • Microsoft — Windows (all supported desktop versions, including 11 24H2)
    Vulnerable versions: all
  • WordPress — WordPress CMS (compromised/vulnerable plugin installations)
    Vulnerable versions: various outdated plugins/themes

Timeline of ClearFake Red Canary July ranking

  • TAG-150 begins development of locked-ioc-34 and associated locked-ioc-29 infrastructure per Recorded Future Insikt Group attribution.
  • PRODAFT first documents locked-ioc-29 (aka CastleBot) as a distinct malware-as-a-service loader family.
  • IBM X-Force identifies locked-ioc-29 distributing MonsterV2 and WARMCOOKIE payloads.
  • TAG-150 locked-ioc-34 Python (PyNightshade/NightshadeC2) and C variants publicly reported by The Hacker News / Recorded Future.
  • locked-ioc-37 actors introduce the CrashFix ClickFix variant using a fake ad-blocker Chrome extension to crash browsers and coerce victims into running fraudulent 'security scan' commands.
  • ClickFix campaigns spread the MacSync macOS infostealer via fake AI tool installers, expanding ClickFix's cross-platform reach.
  • locked-ioc-29's BackgroundFix campaign launches, using fake image-background-removal websites (locked-ioc-19, locked-ioc-11) as ClickFix lures.
  • Trend Micro and Darktrace report locked-ioc-35 operators storing payload-routing JavaScript inside BNB Smart Chain testnet smart contracts (EtherHiding), delivering locked-ioc-36 and locked-ioc-33 via OS-aware branching.
  • New locked-ioc-40 backdoor reported as linked to locked-ioc-37 ClickFix and Python-based ModeloRAT campaigns; locked-ioc-37 shows a significant June 2026 activity increase per Red Canary telemetry.
  • Red Canary publishes Intelligence Insights: July 2026, ranking locked-ioc-35 #1 for a third consecutive month, locked-ioc-37 #2, and locked-ioc-29 debuting at #5 in June 2026 customer telemetry.
  • Threat ingested and researched into the Threadlinqs Intelligence Platform from the Red Canary Blog RSS feed.

Sources cited for ClearFake Red Canary July ranking

More from GrayBravo

Previous and next in malware

Drafted by the Threadlinqs research pipeline from 15 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats