Intelligence Insights: July 2026

What Happened

Attackers are using fake CAPTCHA verification screens on compromised and fake websites to trick people into copying and pasting malicious commands onto their own computers. When users follow the instructions to press Windows+R, Ctrl+V, and Enter, they unknowingly run attacker code. A malware tool called CastleLoader is being distributed this way through fake background removal websites and fake job sites that look like LinkedIn or Indeed. CastleLoader downloads a hidden copy of Python, uses it to fetch encrypted malware, and injects it into running processes to take control of the computer. People using Windows computers and web browsers are the primary targets. Organizations should educate employees about fake CAPTCHA scams, block known malicious domains, and look for suspicious command patterns that use excessive caret characters to hide malicious keywords.

Key Takeaways

• ClearFake remains the top prevalent threat for the third consecutive month, using fake CAPTCHA lures on compromised websites to trick users into executing malicious code via paste and run (ClickFix) techniques
• CastleLoader debuts in the top 10, distributed via paste and run campaigns using fake background removal sites and job platform impersonation domains, delivering payloads including NetSupport Manager RAT, CastleRAT, and a .NET infostealer
• CastleLoader campaigns employ a Bring-Your-Own-Interpreter (BYOI) technique, downloading portable Python distributions disguised as PDFs and renaming the interpreter to random numeric filenames to execute triple-layer encoded shellcode loaders
• KongTuke TDS surged in June 2026, using compromised WordPress sites and paste and run with caret-obfuscated curl commands reaching out to .top domains
• A detection opportunity exists for caret obfuscation in cmd.exe command lines, where multiple caret characters break up keywords like finger or mshta to evade string-based detections

Affected Systems

• Windows endpoints (cmd.exe, finger.exe, python.exe, tar.exe, rundll32.exe, powershell.exe, msiexec.exe)
• macOS systems (targeted by Atomic Stealer and MacSync Stealer)
• Compromised WordPress sites (used by KongTuke TDS)
• Web browsers (JavaScript injection and fake CAPTCHA social engineering)

Vulnerabilities (CVEs)

None identified.

Attack Chain

1. Initial Access: Compromised websites or typosquatted domains present fake CAPTCHA lures instructing users to paste clipboard content into Run dialog (Windows+R, Ctrl+V, Enter)
2. Execution: Paste and run commands use caret-obfuscated cmd.exe with finger.exe or curl to retrieve batch commands from adversary-controlled servers
3. Defense Evasion: Portable Python interpreter (BYOI) downloaded disguised as PDF, extracted with tar.exe, and renamed to random 12-18 digit filename
4. Execution: Python script retrieves triple-layer encoded (Base64, zlib, UTF-32) shellcode loader from C2 with Cyrillic character substitution obfuscation
5. Execution: Shellcode loader fetches RC4-encrypted payload containing CastleLoader binary and injects it into python.exe process
6. Command and Control: Infected python.exe reaches out to C2 servers for configuration, tasking, and additional payloads using 14 launch methods including ShellExecuteW, WinExec, CreateProcessW, rundll32.exe, cmd.exe, powershell.exe, and msiexec.exe

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: Yes
• Platforms: Red Canary pseudo-detection analytic

The article provides a pseudo-detection analytic for identifying caret obfuscation in cmd.exe command lines. The analytic checks for cmd.exe processes where the command line includes multiple caret characters followed by alphabetic characters. No formal YARA, Sigma, Snort, or Suricata rules are provided.

Detection Engineering Assessment

Required Log Sources

• Sysmon Event ID 1 (Process Creation) with command line logging
• Windows Security Event ID 4688 (Process Creation) with command line logging
• Sysmon Event ID 3 (Network Connection)
• Sysmon Event ID 7 (Image Loaded) for DLL monitoring
• Sysmon Event ID 11 (File Creation) for AppData file drops
• EDR process injection detection events
• DNS resolution logs

Hunting Hypotheses

Control Gaps

• Application allowlisting may not block portable Python interpreters executed from user-writable directories
• Network-based detection may miss C2 traffic over HTTPS to newly registered domains without SSL inspection
• Traditional antivirus may not detect caret-obfuscated command lines as malicious without behavioral analysis
• Browser-based protections may not prevent clipboard manipulation from fake CAPTCHA JavaScript
• Sandbox-based analysis may be evaded by cpuid-based virtual machine detection in CastleLoader

Key Behavioral Indicators

• cmd.exe command lines containing multiple caret (^) characters interspersed with alphabetic characters
• finger.exe executing with arguments containing external domain names
• Python interpreter executables with random 12-18 digit numeric filenames in AppData\Local subdirectories
• tar.exe extracting executable files to user AppData directories
• python.exe executing from paths containing ironpython or python-3.x.x-embed-win32 in AppData\Local
• python.exe processes with command lines containing zlib, base64, or subprocess imports indicating encoded script execution
• Process injection into python.exe by shellcode-based loaders
• python.exe making outbound HTTPS connections to unknown domains with unverified SSL contexts

False Positive Assessment

Recommendations

Immediate Mitigation

Infrastructure Hardening

• Consider implementing DNS filtering or sinkholing for newly registered .top domains if your DNS infrastructure supports it
• Evaluate whether finger.exe can be restricted or disabled via AppLocker or WDAC policies, as it is rarely needed in modern environments
• If your network supports SSL inspection, consider inspecting outbound HTTPS traffic from python.exe processes to detect C2 communication
• Consider implementing application allowlisting to prevent execution of unsigned executables from user-writable directories like AppData\Local

User Protection

• Consider deploying browser security extensions that block or warn users about clipboard manipulation by JavaScript on untrusted sites
• If your EDR supports clipboard monitoring, consider enabling alerts for clipboard content containing cmd.exe or powershell.exe execution commands
• Evaluate whether your endpoint protection can detect and block process injection into python.exe processes

Security Awareness

• Consider adding paste and run (ClickFix, fakeCAPTCHA) social engineering to existing security awareness training programs, emphasizing that legitimate CAPTCHA verifications never ask users to press Windows+R, paste content, and press Enter
• Train users to verify job platform URLs by navigating directly to linkedin.com or indeed.com rather than clicking on advertised links
• Consider reminding users that background removal and image editing tools should be accessed through known reputable services, not unfamiliar domains advertised via search results

MITRE ATT&CK Mapping

Additional IOCs

• Command Lines:
  • Purpose: Paste and run initial execution via KongTuke TDS using caret-obfuscated curl command to download from .top domain | Tools: cmd.exe, curl, powershell.exe | Stage: Initial Access | cmd /c start "" /min cmd /v:on /k
  • Purpose: Paste and run initial execution using caret-obfuscated finger.exe to retrieve batch commands from adversary-controlled server | Tools: cmd.exe, finger.exe | Stage: Initial Access | %COMSPEC% /k start "" /min for /f "skip=8 delims=" %h in ('finger
  • Purpose: Execute zlib-compressed Python script to retrieve triple-layer encoded shellcode loader from C2 | Tools: python.exe | Stage: Execution | python -c "import sys,subprocess as s,base64 as b,zlib as z
  • Purpose: Python script reaches out to C2 server over HTTPS to retrieve and execute additional code | Tools: python.exe | Stage: Command and Control | python -c "import ssl,urllib.request