Full Report
A surge in LummaStealer infections has been observed, driven by social engineering campaigns leveraging the ClickFix technique to deliver the CastleLoader malware. [...]
Analysis Summary
# Tool/Technique: LummaStealer/CastleLoader Infection Chain
## Overview
This summary details a recent surge in infections involving **LummaStealer**, an infostealing malware-as-a-service (MaaS) operation, which is being delivered via a multi-stage campaign utilizing the **CastleLoader** malware loader, often initiated through **ClickFix** social engineering.
## Technical Details
- **Type:** Malware (LummaStealer: Infostealer; CastleLoader: Loader/Dropper)
- **Platform:** Primarily Windows (implied by AutoIT/Python loader, PowerShell execution, and common infostealer targets)
- **Capabilities:**
- **LummaStealer:** Information theft (credentials, cookies, crypto wallet data, documents, tokens, VPN configs).
- **CastleLoader:** Modular execution, in-memory loading of payloads, extensive obfuscation, persistence establishment, environment/sandbox evasion.
- **First Seen:** CastleLoader emerged in early 2025. LummaStealer was disrupted in May 2025 but resumed in July 2025. The surge described is from December 2025 to January 2026.
## MITRE ATT&CK Mapping
The primary focus is on the delivery and execution mechanisms provided by CastleLoader and the ClickFix technique.
- **TA0001 - Initial Access**
- T1566 - Phishing
- T1566.001 - Spearphishing Attachment (Delivery mechanism can resemble malicious attachments/downloads)
- **TA0002 - Execution**
- T1059 - Command and Scripting Interpreter
- T1059.001 - PowerShell
- **TA0003 - Persistence**
- T1547 - Boot or Logon Autostart Execution
- T1547.001 - Registry Run Keys / Startup Folder (Achieved via internet shortcut in Startup)
- **TA0005 - Defense Evasion**
- T1027 - Obfuscated Files or Information (Heavy obfuscation in CastleLoader)
- T1070.004 - File Deletion (Implied during cleanup or execution)
- **TA0010 - C2**
- T1573 - Encrypted Channel (Implied by C2 communication)
## Functionality
### Core Capabilities
* **ClickFix Delivery:** Users are tricked into executing a malicious PowerShell command, which is often pre-loaded onto the clipboard via fake CAPTCHA/verification pages.
* **CastleLoader Role:** Acts as the primary delivery mechanism, decrypting, loading, and executing the LummaStealer payload entirely in memory.
* **Information Theft (LummaStealer):** Exfiltrates sensitive data stored across various applications and system locations.
### Advanced Features
* **CastleLoader Obfuscation:** Utilizes dictionary-based renaming, runtime decoding of encoded strings, substantial junk code, dead branches, and complex arithmetic operations to hinder analysis.
* **Environment Checks:** CastleLoader checks for analysis environments (sandboxes) and adjusts its behavior, file paths, and persistence locations based on detected security products.
* **Persistence Mechanism:** Involves copying the malicious AutoIT script and interpreter to a persistence path, and creating an Internet Shortcut file in the OS Startup folder configured to launch the interpreter with the script.
* **Network Artifacts:** CastleLoader deliberately initiates a failed DNS lookup for a non-existent domain, which serves as a unique behavioral artifact for detection.
## Indicators of Compromise
* **File Hashes:** Not provided in the context.
* **File Names:** Scripts or interpreters used by the AutoIT/Python loader (specific names not detailed).
* **Registry Keys:** Persistence relies on shortcuts placed in the Startup path, rather than direct registry manipulation mentioned.
* **Network Indicators:** Artifacts from deliberately initiated DNS failures against non-existent domains. (No C2 IPs/domains provided).
* **Behavioral Indicators:**
* Execution of PowerShell commands obtained from unexpected sources (e.g., clipboard due to a website prompt).
* In-memory loading of secondary payloads (LummaStealer) by CastleLoader.
* Obfuscated execution patterns characteristic of AutoIT/Python scripts being used as loaders.
## Associated Threat Actors
* The primary threat actor group is associated with the **LummaStealer MaaS operation**.
* CastleLoader has also been linked to activity clusters tracked by Recorded Future's **Insikt Group** (associated with GrayBox, though not explicitly stated as the *sole* user in this context).
## Detection Methods
* **Signature-based detection:** Signatures targeting known LummaStealer modules or binaries.
* **Behavioral detection:** Monitoring for suspicious PowerShell execution initiated via social engineering or clipboard manipulation. Detecting the process chain where a script loads and executes a secondary payload entirely in memory (fileless characteristics).
* **YARA rules:** Not provided in the context.
* **Network Artifact Detection:** Specifically look for outgoing network traffic corresponding to failed DNS lookups launched by the initial loader process.
## Mitigation Strategies
* **Avoid Untrusted Sources:** Users should strictly avoid downloading and executing software, media, or archives (especially .EXE files) from unofficial, torrent, or pirated software sites.
* **PowerShell Caution:** Exercise extreme caution regarding executing commands provided via websites, especially for "verification" processes involving PowerShell or command-line utilities.
* **Ad Blocking:** Use ad blockers to hide promoted results on search engines that might link to trojanized software installers.
* **Security Software:** Ensure endpoint detection and response (EDR) tools are configured to monitor for script execution, in-memory payload loading, and persistence mechanisms utilizing application shortcuts.
## Related Tools/Techniques
* **LummaStealer (LummaC2):** The primary information-stealing payload.
* **CastleLoader:** The malware loader used to stage the delivery.
* **ClickFix:** The social engineering technique involving the clipboard to trick users into executing commands.
* **Other Stagers/Infostealers distributed by CastleLoader:** Stealc, RedLine, Rhadamanthys, MonsterV2, CastleRAT, SectopRAT, NetSupport RAT, WarmCookie.