CastleLoader Campaign Deploys NeedleStealer to Steal Crypto Wallet Seeds and Browser Sessions

A significant evolution in the CastleLoader malware ecosystem, with new campaigns deploying the NeedleStealer framework to harvest cryptocurrency wallet seed phrases and hijack browser sessions.

The findings expand on earlier research by Huntress and LevelBlue, confirming that CastleLoader remains a central delivery mechanism for multi-stage intrusions while introducing new tooling written in Rust and Golang.

CastleLoader, previously linked to payloads such as CastleStealer (.NET infostealer), PythonRAT, and NetSupport RAT, continues to operate as a modular shellcode loader.

Earlier reporting from Huntress and LevelBlue established its role in ClickFix-style infection chains and job platform impersonation campaigns.

However, Arctic Wolf’s latest investigation reveals that the threat actors have significantly enhanced the framework’s capabilities by integrating NeedleStealer, a dedicated credential and crypto theft toolkit.

The most notable development comes from the Noidret campaign, where CastleLoader delivers two distinct NeedleStealer payloads. One is a Rust-based desktop wallet spoofer designed to impersonate popular cryptocurrency wallets such as Ledger, Trezor, and Exodus.

The malware presents victims with convincing recovery seed prompts, enabling attackers to capture seed phrases and gain full control over digital assets.

The second payload, written in Golang, installs malicious browser extensions disguised as legitimate tools such as ad blockers, facilitating persistent session hijacking and credential theft.

This marks the first observed use of Rust and Golang within the CastleLoader campaign cluster, indicating a shift toward cross-platform, harder-to-detect tooling.

The NeedleStealer components are deployed via a NodeJS-based injector that decrypts and executes shellcode in memory, further complicating detection and analysis.

Arctic Wolf identified three primary campaigns Urutyka, Garrigin, and Noidret each following a similar multi-stage infection chain but introducing incremental innovations.

In the Urutyka campaign, attackers leveraged obfuscated PowerShell scripts to deliver IronPython-based loaders, ultimately deploying NetSupport RAT and a VNC-based remote access tool, likely Lobshot.

Infrastructure linked to this campaign includes domains such as goodbytetelegramm[.]com and urutyka[.]com, with command-and-control (C2) servers operating over ports 4889.

The Garrigin campaign builds on this structure by introducing a Nullsoft Scriptable Install System (NSIS) dropper masquerading as a Microsoft Edge update.

It deploys CastleStealer via a C/C++ injector, stores payloads in memory, and removes forensic artifacts such as the RunMRU registry key to evade detection.

Associated infrastructure includes grenagana[.]com and garrigin[.]com, alongside a CastleStealer C2 at 179.132.128[.]189.

The Noidret campaign represents the most advanced iteration, combining legacy payloads with NeedleStealer delivery. Domains such as fangorinaf[.]com and quiantar[.]com distribute encrypted payloads retrieved via CastleLoader’s “get_tasks” command.

CastleLoader Campaign Deploys NeedleStealer

Notably, both NeedleStealer variants share the same RC4 encryption key, suggesting coordinated packaging within the infection chain.

The shared C2 domain kileant[.]com remained undetected on VirusTotal at the time of analysis, highlighting the campaign’s stealth.

Additional research uncovered a new wave of CastleLoader distribution via digitally signed installers, a tactic that increases trust and bypasses security controls.

Samples signed by entities such as “Mahu Agro” and “TECHNOLOGY APPRAISALS LIMITED” were observed communicating with infrastructure like qxvnrta[.]com.

Related domains, including kaneta[.]cc and monblare[.]com, appear to be staged for future operations, with valid SSL certificates extending into August 2026.

Across all campaigns, consistent infrastructure patterns emerge. Threat actors rely on unique, nonsensical domain naming conventions to evade detection, reuse specific C2 ports (notably 4889 and 5500), and deploy a shared ~8 KB shellcode loader across variants.

A target such as Ledger, the GUI renders a convincing recovery seed prompt designed to harvest the victim’s seed phrase.

YARA-based retrohunting revealed minimal sample overlap, indicating controlled distribution and targeted operations.

The integration of NeedleStealer into CastleLoader campaigns signals a strategic pivot toward high-value financial theft and session-based account compromise.

Combined with multi-language payload development, in-memory execution, and signed malware delivery, these campaigns present a growing challenge for defenders.

Organizations are advised to monitor for anomalous PowerShell activity, unauthorized browser extensions, and outbound connections to known malicious infrastructure, while leveraging behavioral detection to identify shellcode-based loaders and staged payload execution.

What Features Should AI SOC Have in 2026? A Complete Checklist : Download the AI SOC Features Checklist