CastleRAT Attack Leverages Deno JavaScript Runtime to Bypass Enterprise Defenses

A sophisticated malware campaign that abuses the Deno JavaScript runtime to deliver CastleRAT, a powerful remote access trojan designed for espionage and data theft.

The campaign demonstrates how attackers are increasingly combining social engineering, trusted development tools, and stealth techniques to bypass traditional enterprise defenses.

Instead of relying on conventional malware loaders, the attackers hide their malicious activity behind legitimate software and even conceal payloads inside image files.

The attack begins with a social engineering method known as “ClickFix.” Victims are directed to a compromised or malicious web page that displays a fake browser error message or CAPTCHA verification prompt.

The page instructs the user to copy and paste a command into the Windows Run dialog or terminal to “fix” the issue.

According to an investigation by the ThreatDown Research team, this operation represents the first documented case of threat actors weaponizing the Deno runtime as part of a malware infection chain.

Because the user manually executes the command, security filters that normally block automated downloads may not detect the activity.

Once executed, the command silently downloads and launches a malicious installer that initiates the infection chain.

Abuse of the Deno Runtime

Instead of immediately installing malware, the attackers deploy a stealth technique known as “living off the land,” where legitimate software tools are used to avoid detection.

In this campaign, the initial script downloads and installs Deno, a modern JavaScript runtime widely used by developers. Since Deno is legitimate software with a valid digital signature, most antivirus and endpoint protection systems treat it as trustworthy.

Researchers say this is the first known instance where attackers weaponized the Deno runtime to execute malicious JavaScript.

By running obfuscated scripts inside a trusted Deno process, the attackers gain elevated system access while remaining largely invisible to traditional security tools.

The next stage of the attack introduces an advanced stealth technique involving steganography. The Deno script downloads a portable Python environment disguised as a legitimate component named “Petuhon,” along with a file called CFBAT.jpg.

Although it appears to be a harmless image, the JPEG actually contains an encrypted malware payload.

A heavily obfuscated Python script protected with PyArmor reads the image, extracts the hidden code, and injects the malware directly into system memory.

This process, known as reflective PE loading, allows the malware to run entirely in memory without creating a detectable executable file on disk, making it extremely difficult for traditional antivirus engines to identify.

CastleRAT Takes Control

Once loaded into memory, CastleRAT establishes full control over the infected system. The malware gathers detailed host information, including the computer name, username, machine GUID, product name, and public IP address.

This information is then sent to a command‑and‑control (C2) server, such as 23.94.145.120.

The malware also enables extensive surveillance and data theft capabilities. It records keystrokes using the Windows SetWindowsHookEx API, monitors clipboard data to capture passwords and cryptocurrency addresses, and steals browser cookies, saved credentials, and crypto wallet files.

CastleRAT further targets application session tokens from platforms like Telegram Desktop and Discord, along with developer SSH keys.

It can also activate webcams and microphones using Windows Media APIs to conduct covert audio and video surveillance.

To maintain long‑term access, CastleRAT creates a hidden backdoor shell using inter‑process communication pipes. This allows attackers to remotely control the compromised system without displaying any visible console window.

The malware also establishes persistence by creating a scheduled task through PowerShell, often with misleading names such as “VirtualSmokestGuy666.”

This task relaunches the obfuscated Python loader after every system reboot, ensuring the malware continues operating in memory.

Researchers warn that the CastleRAT campaign highlighted how attackers are shifting toward stealthier, fileless attack methods.

By combining legitimate development tools, steganography, and in‑memory execution, the attackers successfully bypass many traditional detection mechanisms.

Security experts recommend deploying behavior‑based endpoint monitoring capable of detecting unusual process activity, such as Deno instances performing memory injection.

Solutions like ThreatDown can identify these behaviors and block related malware components, including Trojan.CastleLoader and Trojan.CastleRAT, before attackers can steal sensitive data.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.