Pulse Detail — Threat Intelligence

PULSE NAME

IOC - ClickFix Removes Your Background but Leaves the Malware

WHITE ClickFix celestre 2026-05-06 Modified: 2026-05-30

IOCs

MEDIUM VOLUME

MITRE ATT&CK & Malware Families

ATT&CK TECHNIQUES

MALWARE FAMILIES

CastleLoader NetSupport RAT CastleStealer

Indicators of Compromise (5 / 22 total)

All FileHash-SHA256 URL domain

TYPE	INDICATOR	DESCRIPTION	CREATED
URL	http://giovettiadv.com:688	—	2026-05-06
URL	http://poronto.com:688	—	2026-05-06
URL	https://brionter.com/4ba0af68-0037-5f6e-afd1-64f89fc0f554/net40.bin	—	2026-05-06
URL	https://obelnamevalf.org/OaTS7yE9zd/default	—	2026-05-06
URL	https://trindastal.com/8250d149-9bf8-566d-9d7d-ea925eae0a4	—	2026-05-06

References (1)