New MaaS Operator TAG-150 Uses ClickFix Lure and Custom CastleLoader to Compromise 469 US Devices

TAG-150 is a new Malware-as-a-Service (MaaS) operator that has rapidly compromised hundreds of devices in the U.S. since its emergence in early 2025. Utilizing social engineering and a two-pronged malware approach, TAG-150 employs ClickFix to manipulate users into executing malicious commands. The initial delivery mechanism is CastleLoader, which deploys the main payload, CastleRAT, granting attackers extensive control over compromised systems. A stealthy variant, PyNightShade, further enhances their capabilities. The group's rapid success highlights the sophistication and scale of their cyber operations.