CastleRAT abuses Deno runtime for fileless delivery in ransomware-linked ClickFix chain
by Artem Safonov
A five-stage chain uses ClickFix social engineering and the Deno JavaScript runtime to load CastleRAT entirely in memory. ThreatDown calls it the first Deno abuse in malware. Velvet Tempest already deployed CastleRAT in a 12-day ransomware staging operation.
Read more →