CastleLoader Malware Infects 469 Devices Using Fake GitHub Repos and ClickFix Phishing – Cypro By by Christian Yng Published: 2025-07-24 · Archived: 2026-04-05 23:49:08 UTC We value your privacy We use cookies to enhance your browsing experience, serve personalized ads or content, and analyze our traffic. By clicking "Accept All", you consent to our use of cookies. Customize Consent Preferences We use cookies to help you navigate efficiently and perform certain functions. You will find detailed information about all cookies under each consent category below. The cookies that are categorized as "Necessary" are stored on your browser as they are essential for enabling the basic functionalities of the site. ...  Always Active Necessary cookies are required to enable the basic features of this site, such as providing secure log-in or adjusting your consent preferences. These cookies do not store any personally identifiable data. Cookie cookieyes-consent Duration 1 year Description CookieYes sets this cookie to remember users' consent preferences so that their preferences are respected on subsequent visits to this site. It does not collect or store any personal information about the site visitors. Cookie _GRECAPTCHA Duration 5 months 27 days Description https://www.cypro.se/2025/07/24/castleloader-malware-infects-469-devices-using-fake-github-repos-and-clickfix-phishing/ Page 1 of 7 Google Recaptcha service sets this cookie to identify bots to protect the website against malicious spam attacks. Functional cookies help perform certain functionalities like sharing the content of the website on social media platforms, collecting feedback, and other third-party features. Cookie lidc Duration 1 day Description LinkedIn sets the lidc cookie to facilitate data center selection. Cookie UserMatchHistory Duration 1 month Description LinkedIn sets this cookie for LinkedIn Ads ID syncing. Cookie li_gc Duration 5 months 27 days Description Linkedin set this cookie for storing visitor's consent regarding using cookies for non-essential purposes. Analytical cookies are used to understand how visitors interact with the website. These cookies help provide information on metrics such as the number of visitors, bounce rate, traffic source, etc. Cookie _ga Duration https://www.cypro.se/2025/07/24/castleloader-malware-infects-469-devices-using-fake-github-repos-and-clickfix-phishing/ Page 2 of 7 1 year 1 month 4 days Description Google Analytics sets this cookie to calculate visitor, session and campaign data and track site usage for the site's analytics report. The cookie stores information anonymously and assigns a randomly generated number to recognise unique visitors. Cookie _gid Duration 1 day Description Google Analytics sets this cookie to store information on how visitors use a website while also creating an analytics report of the website's performance. Some of the collected data includes the number of visitors, their source, and the pages they visit anonymously. Cookie _ga_* Duration 1 year 1 month 4 days Description Google Analytics sets this cookie to store and count page views. Cookie _gcl_au Duration 3 months Description Google Tag Manager sets the cookie to experiment advertisement efficiency of websites using their services. Cookie AnalyticsSyncHistory https://www.cypro.se/2025/07/24/castleloader-malware-infects-469-devices-using-fake-github-repos-and-clickfix-phishing/ Page 3 of 7 Duration 1 month Description Linkedin set this cookie to store information about the time a sync took place with the lms_analytics cookie. Cookie CONSENT Duration 2 years Description YouTube sets this cookie via embedded YouTube videos and registers anonymous statistical data. Performance cookies are used to understand and analyze the key performance indexes of the website which helps in delivering a better user experience for the visitors. Cookie _gat Duration 1 minute Description Google Universal Analytics sets this cookie to restrain request rate and thus limit data collection on high-traffic sites. Advertisement cookies are used to provide visitors with customized advertisements based on the pages you visited previously and to analyze the effectiveness of the ad campaigns. Cookie test_cookie Duration 15 minutes Description doubleclick.net sets this cookie to determine if the user's browser supports cookies. https://www.cypro.se/2025/07/24/castleloader-malware-infects-469-devices-using-fake-github-repos-and-clickfix-phishing/ Page 4 of 7 Cookie li_sugr Duration 3 months Description LinkedIn sets this cookie to collect user behaviour data to optimise the website and make advertisements on the website more relevant. Cookie bcookie Duration 1 year Description LinkedIn sets this cookie from LinkedIn share buttons and ad tags to recognize browser IDs. Cookie bscookie Duration 1 year Description LinkedIn sets this cookie to store performed actions on the website. Cookie YSC Duration session Description Youtube sets this cookie to track the views of embedded videos on Youtube pages. Cookie VISITOR_INFO1_LIVE https://www.cypro.se/2025/07/24/castleloader-malware-infects-469-devices-using-fake-github-repos-and-clickfix-phishing/ Page 5 of 7 Duration 5 months 27 days Description YouTube sets this cookie to measure bandwidth, determining whether the user gets the new or old player interface. Cookie IDE Duration 1 year 24 days Description Google DoubleClick IDE cookies store information about how the user uses the website to present them with relevant ads according to the user profile. Cookie yt-remote-device-id Duration never Description YouTube sets this cookie to store the user's video preferences using embedded YouTube videos. Cookie yt.innertube::requests Duration never Description YouTube sets this cookie to register a unique ID to store data on what videos from YouTube the user has seen. Cookie yt.innertube::nextId https://www.cypro.se/2025/07/24/castleloader-malware-infects-469-devices-using-fake-github-repos-and-clickfix-phishing/ Page 6 of 7 Duration never Description YouTube sets this cookie to register a unique ID to store data on what videos from YouTube the user has seen. Cookie yt-remote-connected-devices Duration never Description YouTube sets this cookie to store the user's video preferences using embedded YouTube videos. Other uncategorized cookies are those that are being analyzed and have not been classified into a category as yet. Cookie VISITOR_PRIVACY_METADATA Duration 5 months 27 days Description Description is currently not available. Powered by Source: https://www.cypro.se/2025/07/24/castleloader-malware-infects-469-devices-using-fake-github-repos-and-clickfix-phishing/ https://www.cypro.se/2025/07/24/castleloader-malware-infects-469-devices-using-fake-github-repos-and-clickfix-phishing/ Page 7 of 7