CastleLoader Delivery via EvilTokens PhaaS - Phishing Initial Foothold

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

This rule monitors email gateway and EDR telemetry for indicators associated with the CastleLoader malware and the EvilTokens phishing campaign. It flags specific keywords in email subjects, filenames, sender domains, and URLs, as well as suspicious binary execution patterns and child processes spawning from common office applications or web browsers.