CastleRAT Attack Leverages Deno JavaScript Runtime to Bypass Enterprise Defenses

A malware campaign utilizing the Deno JavaScript runtime has been identified, delivering CastleRAT, a remote access trojan designed for data theft and espionage.

The campaign uses social engineering, trusted development tools, and stealth techniques to bypass enterprise defenses. Instead of conventional malware loaders, attackers embed malicious activity within legitimate software and conceal payloads inside image files.

The attack initiates with a social engineering tactic known as "ClickFix," where victims are led to a compromised webpage displaying a fake browser error message or CAPTCHA verification prompt. Users are instructed to input a command into the Windows Run dialog or terminal, bypassing security filters that typically block automated downloads.

Upon execution, the command silently downloads and launches a malicious installer, initiating the infection chain.

Attackers utilize "living off the land" techniques, employing legitimate software tools to avoid detection. The initial script downloads and installs Deno, a widely used JavaScript runtime. As Deno is legitimate and digitally signed, most antivirus and endpoint protection systems consider it trustworthy.

This campaign marks the first known instance of the Deno runtime being weaponized to execute malicious JavaScript. Obfuscated scripts run inside a trusted Deno process, granting attackers elevated system access while evading traditional security tools.

The attack further employs steganography. The Deno script downloads a portable Python environment and a file named CFBAT.jpg, which appears harmless but contains an encrypted malware payload. An obfuscated Python script reads the image, extracts the hidden code, and injects the malware into system memory, avoiding detection by antivirus engines.

Once loaded, CastleRAT gains full control over the infected system, gathering host information and sending it to a command-and-control server. The malware enables extensive surveillance and data theft, including keystroke logging, clipboard monitoring, and theft of browser cookies and credentials.

CastleRAT targets application session tokens from platforms like Telegram Desktop and Discord, along with developer SSH keys. It can activate webcams and microphones for covert surveillance.

To maintain access, CastleRAT creates a hidden backdoor shell and establishes persistence by creating a scheduled task that relaunches the obfuscated Python loader after system reboots.

Security experts highlight a shift toward stealthier, fileless attack methods. To counter these, deploying behavior-based endpoint monitoring capable of detecting unusual process activity, such as Deno instances performing memory injection, is recommended.

Solutions like ThreatDown can identify and block related malware components, including Trojan.CastleLoader and Trojan.CastleRAT, before data theft occurs.

Based on reporting by GBHackers.