CastleLoader Delivery via EvilTokens PhaaS — Browser/Email Spawning Downloader

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects potential CastleLoader delivery by monitoring for suspicious child process executions (e.g., PowerShell, cmd, mshta, wscript, cscript) spawned directly by common browser or email client parent processes. This behavior is indicative of a user interacting with a malicious phishing link or attachment as part of a malware delivery chain.