Full Report
Your background is gone, but malware is here. Huntress breaks down BackgroundFix, a new ClickFix social engineering tactic involving CastleLoader, NetSupport RAT, and CastleStealer. Read the analysis.
Analysis Summary
# Tool/Technique: ClickFix (BackgroundFix Variant) delivering CastleLoader
## Overview
BackgroundFix is a social engineering campaign utilizing the "ClickFix" tactic. It masquerades as a legitimate "remove image background" web service to trick users into executing malicious code. The campaign serves as a delivery mechanism for **CastleLoader**, which subsequently deploys **NetSupport RAT** for remote access and a custom credential stealer dubbed **CastleStealer**.
## Technical Details
- **Type:** Malware Family (Loader/Stealer/RAT) and Social Engineering Technique
- **Platform:** Windows
- **Capabilities:** Credential theft, remote access, clipboard hijacking, and Living-off-the-Land (LotL) execution.
- **First Seen:** April 2024 (Reported April 30, 2026 in provided context)
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1566.002 - Phishing: Spearphishing Link (via SEO Poisoning/Malicious Sites)
- **TA0002 - Execution**
- T1059.003 - Command and Scripting Interpreter: Windows Command Shell
- T1204.002 - User Execution: Malicious File
- **TA0005 - Defense Evasion**
- T1218 - System Binary Proxy Execution (via finger.exe)
- T1027 - Obfuscated Files or Information
- **TA0006 - Credential Access**
- T1555 - Credentials from Password Stores (Browser/Wallet data)
## Functionality
### Core Capabilities
- **Social Engineering (ClickFix):** Uses a fake web UI with progress bars. When the user clicks "I'm not a robot," a PowerShell/CMD command is copied to their clipboard. The user is then instructed to manually paste and run the command.
- **Finger Protocol Abuse:** Uses `finger.exe` (a native Windows utility) to fetch a malicious payload from a remote server (`cheeshomireciple[.]com`), bypassing traditional web filters.
- **Payload Loading:** CastleLoader executes and drops further stages, including a .NET-based stealer and an RMM tool.
### Advanced Features
- **CastleStealer:** A custom .NET stealer specifically targeting Telegram session files, browser credentials, and cryptocurrency wallet extensions.
- **Execution Errors:** The article notes a flaw in CastleLoader's code where it attempts to call `regsrv32.exe` (a typo of `regsvr32.exe`), causing specific "Method 4" executions to fail.
- **Telemetry:** The landing page uses `navigator.sendBeacon` to notify the attacker via `log-checkbox.php` when a victim reaches the final infection step.
## Indicators of Compromise
- **File Names:** `BackgroundFix.exe`, `CastleLoader.exe`
- **Network Indicators:**
- `cheeshomireciple[.]com` (C2/Payload Delivery via Finger)
- `log-checkbox.php` (Telemetry endpoint)
- `backgroundfix[.]com` (Malicious Landing Page)
- **Behavioral Indicators:**
- Execution of `%COMSPEC%` with `finger.exe` commands.
- Unexpected use of `finger.exe` to connect to external domains.
- Creation of hidden directories for NetSupport RAT files.
## Associated Threat Actors
- **ClickFix Campaign Operators:** Known for using the "copy-paste to terminal" social engineering lure.
## Detection Methods
- **Behavioral Detection:**
- Monitor for `cmd.exe` or `powershell.exe` spawning `finger.exe`.
- Alert on `finger.exe` initiating network connections to non-standard external IPs.
- **Signature-based:** Detect the specific XOR-decoded helper strings used by CastleLoader.
- **Web Security:** Block known ClickFix landing page domains and monitor for `navigator.sendBeacon` pings to suspicious PHP scripts.
## Mitigation Strategies
- **User Education:** Train users to never paste and execute commands from websites, especially those claiming to be "robot verification."
- **Host Hardening:** Disable or restrict the use of `finger.exe` if not required for business operations.
- **Network Filtering:** Block the Finger protocol (Port 79) at the firewall level.
## Related Tools/Techniques
- **NetSupport RAT:** A legitimate remote support tool frequently repurposed by attackers.
- **Potemkin Loader:** Another loader recently associated with ClickFix campaigns.
- **ClearFake:** A similar social engineering framework that uses fake browser update overlays.