CastleLoader Delivery via ClickFix CAPTCHA Lure - Browser Spawning Shell

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•2

Detects anomalous child process execution (PowerShell, mshta, wscript, cscript, or cmd) spawned by common web browsers, which is consistent with the execution chain of CastleLoader malware delivered via EvilTokens PhaaS and ClickFix CAPTCHA lures. These lures typically trick users into copying and pasting commands into the Run dialog or directly into the shell.