Do Son 
Wallet Spoofer’s fake user interfaces
At a glance
| Malware family | CastleLoader (loader); payloads include CastleStealer, NetSupport RAT, Lobshot, and NeedleStealer |
|---|---|
| Threat actor | Not named in this report; the loader is publicly tied to a closed malware-as-a-service operation (suspected) |
| Targets | Windows users, crypto wallet holders, and browser sessions |
| Delivery vector | Fake software installers and ClickFix-style lures, some digitally signed |
| Key capabilities | In-memory staged loading, encrypted C2 tasking, wallet seed theft, browser session hijacking |
| Source | Arctic Wolf Labs |
TL;DR
CastleLoader malware has gained new payloads that hunt cryptocurrency wallets and browser sessions. Arctic Wolf Labs links three fresh campaigns to a stealer framework called NeedleStealer. The tooling marks the first time this cluster has used Rust and Golang code.
How CastleLoader gets in
The intrusion starts with a fake installer. In several campaigns, the download poses as a Microsoft Edge update and lands in a folder made to look like a real EdgeUpdate directory. The dropper also strips the Mark-of-the-Web tag, which helps it slip past SmartScreen.
ClickFix-style lures play a role too. These prompts push users to run PowerShell or paste commands by hand. Some installers even carry valid code-signing certificates, which lowers suspicion and dodges basic controls.
CastleLoader is not new. Swiss firm PRODAFT first documented it in 2025 and reported 469 infected devices from 1,634 attempts, a 28.7% success rate. Other vendors, including Recorded Future and IBM X-Force, have tracked it as a shared loader for many payloads. These fresh campaigns show the platform still evolving fast.
The infection chain
Once running, the loader unfolds in stages. An obfuscated PowerShell stager fetches a second script. That script launches an embedded Python runtime, which injects shellcode entirely in memory. The shellcode then pulls the final CastleLoader stage and asks the server for tasks.
Those tasks return encrypted payloads. Each one uses its own RC4 key, so analysis is harder. Arctic Wolf worked around that. Using keys pulled from the loader, the team says it could “decrypt the HTTP response and confirm the payload manifest” without ever running the malware.
The payload mix varies by campaign. NetSupport RAT gives the operator hands-on remote control. A VNC-based viewer, likely a Lobshot variant, adds another view into the host. CastleStealer, a .NET infostealer, rounds out the older toolkit.
NeedleStealer joins the CastleLoader malware toolkit
The headline change is NeedleStealer. Arctic Wolf calls it “the first observed use of Rust and Golang tooling within this campaign cluster.” The framework ships two payloads, and both aim straight at money.
A Rust wallet spoofer
The first payload is a crypto wallet spoofer written in Rust. It shows fake wallet screens for Ledger, Trezor, and Exodus. When a victim reacts to a staged error, the app displays a recovery-seed prompt. That prompt harvests the seed phrase, which hands attackers full control of the funds.
A Golang browser hijacker
The second payload targets browsers. It installs a malicious extension that poses as an ad blocker, while planting real-looking extensions to blend in. The rogue extension keeps access to browser sessions. As a result, it can steal session tokens and login credentials over time.
Why crypto wallets now?
The shift looks deliberate. Seed phrases are high-value and hard to claw back. Rust and Golang binaries also draw fewer static detections than .NET tools. Arctic Wolf suggests the operator may even rent NeedleStealer rather than build it.
C2 and data exfiltration
CastleLoader talks to its servers over HTTP with encrypted, serialized data. The NeedleStealer command domain stayed marked “clean” on VirusTotal during the analysis. That gap shows how fresh infrastructure evades reputation checks.
The stolen data speaks to the goal. Wallet seed phrases enable direct theft. Browser tokens and passwords open more accounts and inboxes. Notably, the tooling is scarce; a year-long retrohunt surfaced only three related samples, which Arctic Wolf reads as “tightly controlled and not broadly distributed.”
How to defend
Start with execution control. Block unsigned or oddly signed binaries that launch from user-writable folders like ProgramData. Do not trust a code signature alone; pair it with reputation and behavior checks.
Watch the scripting layers next. Enable PowerShell script block logging. Alert on embedded Python runtimes or Node.js running from unusual paths. Teach staff to reject ClickFix prompts that ask them to paste commands. For the full indicators and analysis, read the Arctic Wolf Labs report. This CastleLoader malware research also builds on prior CastleStealer and NeedleStealer coverage from Huntress, Malwarebytes, and others.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
