BackgroundFix is a social engineering lure disguised as an image background removal tool that prompts users to verify they are human by copying malicious commands to their clipboard. These commands invoke finger.exe to download additional payloads, leading to the deployment of CastleLoader. CastleLoader uses reflective PE injection, API hashing, and ChaCha20 encryption for C2 communications to deliver NetSupport RAT and CastleStealer. CastleStealer steals browser credentials, cryptocurrency wallet extensions, and Telegram session data by leveraging DPAPI decryption and Restart Manager APIs. The campaign uses Bring Your Own Interpreter (BYOI) tactics with embedded Python interpreters and multiple shellcode stages. A notable flaw in the malware references regsrv32.exe instead of regsvr32.exe, causing silent launch failures. There is no indication of known exploits in the wild or vendor advisories providing patches.

The malware enables attackers to steal sensitive user data including browser credentials, cryptocurrency wallet information, and Telegram session data. It establishes persistent remote access via NetSupport RAT, allowing ongoing control of infected systems. The use of encrypted communications and advanced injection techniques complicates detection and analysis. The social engineering aspect increases the likelihood of user infection. The implementation flaw causing silent failures may reduce some infection success but does not eliminate the threat.

No official patch or remediation guidance is currently available for this threat. Defenders should focus on user education to recognize and avoid social engineering lures like BackgroundFix. Blocking known malicious domains and URLs associated with this campaign can help reduce exposure. Endpoint detection and response solutions should be tuned to detect behaviors related to reflective PE injection, API hashing, and the presence of NetSupport RAT and CastleStealer components. Monitor for suspicious clipboard activity and execution of finger.exe or similar unusual processes. Since this is not a vulnerability but a malware campaign, traditional patching does not apply.