Roundup cites infostealers, malicious packages and ClickFix as rising malware trends
Immersive says Lumma Stealer, StealC and RisePro now account for 75% of stolen credentials sold for initial access.
34
Malware
CastleLoader
- Mentions · 7d0
- Mentions · 30d3
- All mentions6
- First seenSep 10, 2026
- Last mentioned11d ago
Timeline
6 articles · newest firstCastleStealer Malware Uses Browser Protection Bypass and Remote Shell to Expand Attacker Access
CastleStealer now bypasses Chromium App-Bound Encryption and adds a remote shell on Windows.
62
CastleStealer Malware Bypasses Chromium ABE and Adds Remote Command Execution Capabilities
CastleStealer now bypasses Chromium app-bound encryption, runs remote commands, and exfiltrates data over encrypted TCP.
56
Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement
Zscaler discovered SloppyRAT, a ClickFix-delivered RAT that gives ransomware operators reconnaissance, remote execution, and SOCKS proxy pivoting for lateral movement.
52
Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement
Zscaler ThreatLabz reports SloppyRAT, a new Windows RAT delivered via ClickFix lures that supports reconnaissance, reverse SOCKS proxying, and lateral movement for ransomware affiliates.
50
SloppyRAT: A New Tool For Ransomware Attacks
Zscaler details SloppyRAT, a new DLL backdoor delivered via ClickFix lures that stages CastleLoader and CastleRAT ahead of ransomware attacks.
48
Appears with
- Zscalervendor · 3
- SloppyRATmalware · 3
- CastleRATmalware · 3
- Firefoxproduct · 2
- Node.jsproduct · 2
- Chromeproduct · 2
- Chromiumproduct · 2
- Flashpointorganization · 2
- OXLOADERmalware · 2
- Microsoftvendor · 2
- CastleStealermalware · 2
- Googlevendor · 2
- Discordproduct · 1
- LockBitthreat actor · 1
- Immersiveorganization · 1
- HuggingFaceproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.