# Red Canary Intelligence Insights July 2026: ClearFake Leads Third Straight Month Amid CastleLoader Debut and Caret-Obfuscated Paste-and-Run Campaigns

> Red Canary's June 2026 threat prevalence ranking shows ClearFake retaining the #1 spot for a third consecutive month via fake-CAPTCHA ClickFix (T1204.004) drive-by lures now backed by EtherHiding BSC-testnet smart-contract C2, while KongTuke (WordPress-abusing ClickFix/CrashFix TDS) surged and TAG-150's CastleLoader debuted in the top 10, delivering NetSupport Manager, CastleRAT (Python/PyNightshade and C variants), and undisclosed .NET infostealers. Adversaries are converging on caret-character CLI obfuscation, Bring-Your-Own-Interpreter (portable CPython/IronPython) execution, and triple-layer Base64/zlib/UTF-32-with-Cyrillic-substitution encoding to defeat static and command-line detection.

- **Published:** 2026-07-23T00:00:00Z
- **Last reviewed:** 2026-07-23T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1658
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-clearfake-red-canary-july-ranking-tl-2026-1658.webp?v=06a49418 (Threadlinqs threat intel: ClearFake Tops Red Canary Ranking Again: Detection & IOCs (TL-2026-1658) — Medium severity, 41 IOCs, 9 detection rules.)
- **ID:** TL-2026-1658
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** GrayBravo
- **Detections:** 9 (1 shown free below) · **IOCs:** 41 (3 shown free below)

## Description

Red Canary's July 2026 Intelligence Insights report (covering June 2026 telemetry) confirms ClearFake as the most prevalent threat observed across customer environments for a third consecutive month. ClearFake is a JavaScript injection cluster that compromises legitimate WordPress sites to serve fake CAPTCHA / fake browser-update overlays that trick victims into pasting and executing attacker-supplied commands (ClickFix / T1204.004 Malicious Copy and Paste). In 2026 ClearFake operators (tracked historically to Storm-1607/Storm-0426/Storm-0249 infrastructure and the TA571-linked ClearFake compromise group) have adopted EtherHiding, storing payload-routing JavaScript directly inside immutable BNB Smart Chain (BSC) testnet smart contracts, making the delivery infrastructure effectively takedown-resistant. Confirmed final-stage payloads from the EtherHiding chain include SectopRAT (.NET browser-hijacking RAT) and ACRStealer (C++ infostealer), delivered via OS-aware branching for Windows and macOS victims.

KongTuke (aka Chaya_002 / LandUpdate808 / TAG-124), ranked #2 and showing a significant June 2026 activity increase, is a traffic distribution system that injects malicious JavaScript into compromised WordPress installations to serve ClickFix-family lures — FakeCAPTCHA, FileFix, and the newer CrashFix variant, which uses a malicious Chrome extension masquerading as an ad blocker to intentionally crash the browser and coerce the victim into running a fraudulent "security scan" command. KongTuke traffic has been linked to delivery of LummaC2, MintsLoader, D3F@ck Loader, Mocha Manakin, WARMCOOKIE, the new Mistic backdoor, Python-based modeloRAT, and downstream Rhysida/Interlock ransomware deployment.

CastleLoader, debuting in the top 10 at rank #5, is a malware-as-a-service (MaaS) loader operated by TAG-150 (Recorded Future Insikt Group attribution), active since at least March 2025 and first documented by PRODAFT in July 2025 (also tracked as CastleBot). Distribution is primarily via Cloudflare-themed ClickFix phishing pages and fraudulent GitHub repositories impersonating legitimate applications, plus SEO-poisoned fake download portals and a BackgroundFix campaign (April 2026) using fake background-image-removal utility sites. The infection chain begins with caret-obfuscated (^) command strings invoking the living-off-the-land binary finger.exe against an attacker-controlled TCP/79 daemon (Signed Binary Proxy Execution) to retrieve a Bring-Your-Own-Interpreter (BYOI) stage: a portable, unmodified CPython or IronPython interpreter renamed to a random numeric filename, deployed alongside a Base64/zlib-compressed Python script. That script is wrapped in an additional UTF-32 encoding layer with Cyrillic-character substitution before being RC4-decrypted and shellcode-injected into python.exe/pythonw.exe, executing entirely in memory. The resulting five-stage kill chain (clipboard execution -> shellcode stager with PEB-walking/DJB2 API hashing -> PE loader using direct NtAllocateVirtualMemory calls and PEB_LDR_DATA manipulation to evade EDR hooks, including an NtManageHotPatch hook for Windows 11 24H2 -> ChaCha20-encrypted core backdoor) culminates in delivery of CastleRAT (Python variant aka PyNightshade/NightshadeC2, and a more capable C variant with keylogging, screenshot capture, and cryptocurrency-clipper functionality), NetSupport Manager RAT, and previously reported payloads including DeerStealer, RedLine, StealC, SectopRAT, MonsterV2, and WARMCOOKIE. C2 uses a four-tier architecture (victim-facing servers, tiered VPS relays, backup servers) with Steam Community profiles used as dead-drop resolvers pointing to real C2 infrastructure, and IP-API geolocation lookups used for victim targeting.

Across all three clusters, Red Canary highlights a converging evasion toolkit: caret-character (^) obfuscation of cmd.exe strings to defeat literal-string detections, BYOI execution using portable interpreters to avoid file-based AV signatures on system Python installs, and multi-layer Base64/zlib/UTF-32 encoding with Cyrillic substitution to break naive Base64/string-matching detections. Red Canary's published detection opportunity targets command-processor invocations containing multiple caret characters used to obfuscate CLI strings, plus explorer.exe spawning cmd.exe with 'start'/'exit' arguments characteristic of paste-and-run lures.

## MITRE ATT&CK

- T1189 Drive-by Compromise
- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1053 Scheduled Task/Job
- T1055 Process Injection
- T1548 Abuse Elevation Control Mechanism
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1218 System Binary Proxy Execution
- T1620 Reflective Code Loading
- T1055 Process Injection
- T1685 Disable or Modify Tools
- T1497 Virtualization/Sandbox Evasion
- T1082 System Information Discovery
- T1497 Virtualization/Sandbox Evasion
- T1056 Input Capture
- T1113 Screen Capture
- T1115 Clipboard Data
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1573 Encrypted Channel
- T1568 Dynamic Resolution
- T1571 Non-Standard Port
- T1486 Data Encrypted for Impact

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Caret-Obfuscated Command Line — CastleLoader/ClickFix Paste-and-Run Exploitation** (`TL-2026-1658-SPL-001`)

Detects cmd.exe/PowerShell command lines containing 3+ caret (^) characters used to defeat literal-string detection, consistent with CastleLoader/TAG-150 ClickFix tradecraft (e.g. f^i^n^g^e^r nrLeDHDESi@cheeshomireciple.com), and explorer.exe spawning cmd.exe with 'start'/'exit' arguments characteristic of clipboard paste-and-run lures.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.004, T1027, T1218
- **Data sources:** sysmon, windows_security
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\cmd.exe" OR Image="*\\powershell.exe")
| eval caret_count=mvcount(split(CommandLine, "^"))-1
| where caret_count>=3 OR (ParentImage="*\\explorer.exe" AND Image="*\\cmd.exe" AND like(CommandLine, "%start%") AND like(CommandLine, "%exit%"))
| table _time, ComputerName, User, ParentImage, Image, CommandLine, caret_count
| sort -_time
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("cmd.exe", "powershell.exe")
| extend caret_count = array_length(split(ProcessCommandLine, "^")) - 1
| where caret_count >= 3 or (InitiatingProcessFileName =~ "explorer.exe" and FileName =~ "cmd.exe" and ProcessCommandLine has "start" and ProcessCommandLine has "exit")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, caret_count
| order by Timestamp desc
```

### Sigma

```yaml
title: Caret-Obfuscated Command Line or Explorer ClickFix Paste-and-Run (CastleLoader)
id: e1a4c9d2-2f6b-4e3a-9c1d-1a2b3c4d5e6f
status: experimental
description: Detects cmd.exe/PowerShell command lines with 3+ caret characters used as string-obfuscation evasion, or explorer.exe spawning cmd.exe with start/exit arguments consistent with ClickFix paste-and-run lures (ClearFake/KongTuke/CastleLoader).
references:
    - https://redcanary.com/blog/threat-intelligence/intelligence-insights-july-2026/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-23
tags:
    - attack.defense-evasion
    - attack.execution
    - attack.t1027
    - attack.t1204.004
    - attack.tool.castleloader
logsource:
    category: process_creation
    product: windows
detection:
    selection_caret:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|re: '(\^.){3,}'
    selection_clickfix:
        ParentImage|endswith: '\explorer.exe'
        Image|endswith: '\cmd.exe'
        CommandLine|contains|all:
            - 'start'
            - 'exit'
    condition: selection_caret or selection_clickfix
    falsepositives:
        - Legitimate scripts using carets for line continuation in batch files
        - Admin tooling that spawns cmd.exe from Explorer for benign start/exit usage
    level: high
```

**Known false positives:**

- Legitimate batch scripts using carets for multi-line command continuation
- IT admin scripts spawning cmd.exe from Explorer for benign automation

**Tuning notes:** Tune caret_count threshold per environment baseline; exclude known packaging/deployment tools (SCCM, Intune scripts) that legitimately use carets. Correlate with parent process explorer.exe for higher-fidelity ClickFix detection.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Portable/Renamed Python Interpreter Executing from User-Writable Path — BYOI Post-Exploitation Stage (locked: unlock with TL Creds)
- Mismatched-Extension Archive Drop and Reinfection Marker — CastleLoader Post-Exploitation Artifacts (locked: unlock with TL Creds)
- Process Hollowing / Reflective Code Loading into python.exe via Direct NtAllocateVirtualMemory — CastleRAT Post-Exploitation Injection (locked: unlock with TL Creds)
- WordPress-Injected KongTuke TDS JavaScript Naming Pattern — C2/Beacon Detection (locked: unlock with TL Creds)
- EtherHiding Blockchain RPC C2 Retrieval from Browser Process — ClearFake Smart-Contract C2 (locked: unlock with TL Creds)
- CastleLoader/CastleRAT Task-Tasking C2 URI and Steam Dead-Drop Resolver Beacon — C2 Lateral Movement (locked: unlock with TL Creds)
- finger.exe LOLBin [indicator] Stage Retrieval — CastleLoader Signed Binary Proxy Execution (locked: unlock with TL Creds)
- explorer.exe → cmd.exe → finger.exe Process Lineage — CastleLoader Initial Exploitation Chain (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 41)

Defanged, TLP:CLEAR.

- Domain: `programsbookss[.]com`
- Domain: `ai-scan[.]digital`
- Domain: `bg-transparency[.]online`

Full set of 41 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Intelligence Insights: July 2026](https://redcanary.com/blog/threat-intelligence/intelligence-insights-july-2026/)
- [KongTuke | Red Canary Threat Detection Report](https://redcanary.com/threat-detection-report/threats/kongtuke/)
- [TAG-150 Develops CastleRAT in Python and C, Expanding CastleLoader Malware Operations](https://thehackernews.com/2025/09/tag-150-develops-castlerat-in-python.html)
- [CastleLoader attack dissection: 5-stage kill chain breakdown](https://www.manageengine.com/malware-protection/adversaries/castleloader.html)
- [CastleLoader & CastleRAT: Behind TAG150's Modular Malware Delivery System](https://www.darktrace.com/blog/castleloader-castlerat-behind-tag150s-modular-malware-delivery-system)
- [CastleLoader Malware Now Uses Python Loader to Bypass Security](https://hackread.com/castleloader-malware-python-loader-bypass-security/)
- [Snakes in the Castle: Inside the Walls of Python-Driven CastleLoader Delivery](https://blackpointcyber.com/blog/python-driven-castleloader-analysis/)
- [New Mistic Backdoor Linked to KongTuke in ClickFix and ModeloRAT Campaigns](https://thehackernews.com/2026/06/new-mistic-backdoor-linked-to-kongtuke.html)
- [Through the Lens of MDR: Analysis of KongTuke's ClickFix Abuse of Compromised WordPress Sites](https://www.trendmicro.com/en_us/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html)
- [Threat Profile | Toxic Trio: KongTuke, ClickFix, and Havoc Campaign](https://packetwatch.com/resources/threat-profile/threat-profile-kongtuke-clickfix-havoc-campaign)
- [ClearFake: From Fake CAPTCHAs to Blockchain-Driven Payload Retrieval](https://www.darktrace.com/blog/clearfake-from-fake-captchas-to-blockchain-driven-payload-retrieval)
- [Smart Contracts for C&C: How ClearFake Hid in Plain Sight on BSC Testnet](https://www.trendmicro.com/en_us/research/26/e/smart-contracts-for-command-and-control.html)
- [ClickFix Attacks Expand Using Fake CAPTCHAs, Microsoft Scripts, and Trusted Web Services](https://thehackernews.com/2026/01/clickfix-attacks-expand-using-fake.html)
- [User Execution: Malicious Copy and Paste, Sub-technique T1204.004](https://attack.mitre.org/techniques/T1204/004/)
- [ClickFix Campaigns Spread MacSync macOS Infostealer via Fake AI Tool Installers](https://thehackernews.com/2026/03/clickfix-campaigns-spread-macsync-macos.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1658