Arctic Wolf Labs has uncovered new CastleLoader campaigns using digitally signed installers, Mark-of-the-Web (MotW) removal, and in-memory shellcode injection to deliver malware.
The activity expands an already active campaign cluster linked to CastleStealer, PythonRAT, NetSupport RAT, and newly observed NeedleStealer payloads.
CastleLoader is a multi-stage loader commonly distributed through fake software installers, ClickFix lures, and obfuscated PowerShell scripts.
The latest activity shows threat actors improving their delivery chain with signed files that appear more trustworthy to users and security products.
Researchers identified a new CastleLoader shellcode loader variant communicating with qxvnrta[.]com.
Multiple malicious installers tied to this infrastructure carried valid digital signatures, including certificates associated with Mahu Agro and TECHNOLOGY APPRAISALS LIMITED.
Signed CastleLoader Evades MotW
Code signing normally helps users verify software origin and integrity. In this case, the attackers appear to have abused or fraudulently obtained certificates to make malicious installers look legitimate.
This can reduce suspicion and potentially weaken defenses that place too much trust in signed executables. The Garrigin campaign demonstrates how the group removes another important Windows security signal.
Its PowerShell downloader creates a fake Microsoft Edge update folder at %ProgramData%\EdgeUpdate\, downloads traffic1.exe, strips the Zone. Identifier alternate data stream, and then runs the hidden executable.
The Zone. Identifier stream is Windows’ Mark-of-the-Web mechanism. It records that a file originated from the internet and can trigger security warnings, SmartScreen checks, and additional scrutiny.
Removing it before execution helps the malware evade controls designed to identify downloaded files. The traffic1.exe payload is an NSIS installer that deploys an embedded IronPython runtime and an encoded script.
The script retrieves CastleLoader’s second-stage shellcode, which is injected directly into memory. This reduces the malware’s on-disk footprint and complicates file-based detection.
The Noidret campaign is the most significant development because it adds NeedleStealer components to the CastleLoader delivery chain.
Alongside NetSupport RAT and CastleStealer, the campaign deploys Rust- and Golang-based tools targeting cryptocurrency wallets and web browsers.
One NeedleStealer payload is a Rust-based desktop wallet spoofer. It is delivered with a legitimate Node.js binary and encrypted files placed under ProgramData\NodeJS.
A Node.js injector decrypts a small shellcode stub, which reflectively loads the wallet-focused payload into memory. The wallet spoofer can imitate recovery interfaces for Ledger, Trezor, and Exodus wallets.
Its goal is to deceive victims into entering recovery seed phrases, which can give attackers complete control of cryptocurrency holdings, arcticwolf said.
A second NeedleStealer component, written in Golang, installs malicious browser extensions while adding benign-looking extensions to avoid attention.
In the observed campaign, the malicious extension masqueraded as an ad blocker. Such extensions can maintain browser-level access, steal session tokens, and capture credentials even after users reset passwords.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
 removal, and in-memory){kind=link}