--- title: "ClickFix Removes Your Background but Leaves the Malware" url: https://daily.dev/posts/clickfix-removes-your-background-but-leaves-the-malware-rw2owypse source_url: https://www.huntress.com/blog/clickfix-castleloader-backgroundfix type: article source: "Huntress Blog" published: 2026-05-31T07:43:27.265Z updated: 2026-05-31T08:58:22.627Z tags: ["security", "malware"] reading_time: 32 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # ClickFix Removes Your Background but Leaves the Malware **[Huntress Blog](https://daily.dev/sources/huntress-blog)** · 32 min read · 0 upvotes · 0 comments ## Summary Huntress researchers dissect a ClickFix campaign dubbed 'BackgroundFix' that lures victims through a fake AI background-removal site. Clicking a fake CAPTCHA copies a malicious command to the clipboard that uses the legacy Windows finger.exe client to fetch a batch payload. The chain downloads a legitimate Python embeddable runtime, uses it as a bring-your-own-interpreter loader, and ultimately deploys CastleLoader — a custom multi-stage loader using RC4, ChaCha20, reflective PE loading, PEB rewriting, and the ReplaceTextW dialog hook trick to evade EDRs. CastleLoader then delivers NetSupport RAT for persistent remote access and CastleStealer, a .NET credential stealer targeting Chromium passwords, crypto wallet extensions, Discord tokens, and Telegram session data. Defenders can break the chain by blocking the Run dialog, blocking outbound TCP port 79 (finger), and keeping Chromium browsers updated to benefit from App-Bound Encryption. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Fake Google and Cloudflare verification pages spread multiple malware families](https://daily.dev/posts/fake-google-and-cloudflare-verification-pages-spread-multiple-malware-families-8s8xqrwfw) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/clickfix-removes-your-background-but-leaves-the-malware-rw2owypse)