CastleLoader Campaign Deploys NeedleStealer to Steal Crypto Wallet Seeds and Browser Sessions

Gbhackers •Mayura Kathir • July 28, 2026

A significant evolution in the CastleLoader malware ecosystem, with new campaigns deploying the NeedleStealer framework to harvest cryptocurrency wallet seed phrases and hijack browser sessions. The findings expand on earlier research by Huntress and LevelBlue, confirming that CastleLoader remains a central delivery mechanism for multi-stage intrusions while introducing new tooling written in Rust and Golang. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CastleLoader Campaign Uses NeedleStealer to Target Crypto Users The CastleLoader malware campaign has evolved, deploying the NeedleStealer framework to steal cryptocurrency wallet seed phrases and hijack browser sessions. This operation targets Windows devices through fake software installers and deceptive prompts. Recent findings from Huntress and LevelBlue confirm that CastleLoader remains a primary delivery mechanism for multi-stage intrusions. Attackers use convincing fake wallet screens and browser extensions to harvest sensitive information. The scope of the attack is significant, affecting numerous users who interact with cryptocurrency applications. Current reports indicate that the campaign is ongoing, with new tools developed in Rust and Golang being utilized. Security professionals are advised to remain vigilant against these tactics. 2 sources 67

Extracted Entities

CastleLoader Campaign Deploys NeedleStealer to Steal Crypto Wallet Seeds and Browser Sessions

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Malware (2)