ThreatCluster

CastleLoader Campaign Uses NeedleStealer to Target Crypto Users

First seen 29 Jul 2026, 02:49 UTC • •67

Article Content

1 / 3

Browse articles

ThreatCluster •July 30, 2026 at 01:53 UTC

•CastleLoader malware now deploys NeedleStealer to steal crypto wallet seeds.
•Attackers use fake wallet screens and browser extensions to harvest sensitive data.
•The campaign primarily targets Windows devices through deceptive software installers.

The CastleLoader malware campaign has evolved, deploying the NeedleStealer framework to steal cryptocurrency wallet seed phrases and hijack browser sessions. This operation targets Windows devices through fake software installers and deceptive prompts. Recent findings from Huntress and LevelBlue confirm that CastleLoader remains a primary delivery mechanism for multi-stage intrusions. Attackers use convincing fake wallet screens and browser extensions to harvest sensitive information. The scope of the attack is significant, affecting numerous users who interact with cryptocurrency applications. Current reports indicate that the campaign is ongoing, with new tools developed in Rust and Golang being utilized. Security professionals are advised to remain vigilant against these tactics.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 54d ago How this analysis works

Timeline

2026-07-28

CastleLoader campaign evolves with NeedleStealer

New findings reveal the use of NeedleStealer for stealing crypto wallet seeds and browser sessions, confirming ongoing threats.

2026-07-28

Fake crypto wallet screens identified

Criminals are using convincing fake wallet screens to steal recovery phrases and login data linked to the CastleLoader campaign.

Cybersecuritynews

More articles in this cluster (2)

Threat Graph

7 entities, 5 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Malware
Phishing
T1566 - Phishing

Campaign (1)

CastleLoader Campaign

Malware (2)

CastleLoader
NeedleStealer

Affected Platform (1)

Windows

Relationships

CastleLoader Campaign uses CastleLoader
CastleLoader Campaign uses NeedleStealer
Malware targets Windows
Phishing targets Windows
T1566 - Phishing targets Windows

Following this threat?

Track CastleLoader in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

SloppyRAT: New Remote Access Trojan Fuels Ransomware Operations In June 2026, Zscaler ThreatLabz identified SloppyRAT, a new remote access trojan (RAT) used in ransomware attacks. Delivered through a multi-stage ClickFix infection chain, SloppyRAT employs advanced evasion techniques, including encrypted code and indirect Windows system calls. The malware allows attackers to…

Critical WSO2 API Manager Vulnerability Under Active Exploitation A critical vulnerability (CVE-2026-5430) in WSO2 API Manager is being actively exploited, allowing unauthenticated attackers to forge admin tokens via JWT authentication bypass. This flaw, which has a CVSS score of 10.0, affects multiple WSO2 products including API Manager, Universal Gateway, Traffic Manager, and API…