'What started as someone potentially trying to remove the background from a selfie ended with a custom .NET stealer rifling through their browser passwords': Experts warn that free image editor tool could actually be dangerous malware

Malware attack virus alert , malicious software infection , cyber security awareness training to protect business.

• A fake photo tool ranked high in search results tricks users into running malware via ClickFix tactics
• Victims first get infected with CastleLoader, which then deploys NetSupport RAT and a custom CastleStealer
• The campaign highlights how SEO poisoning and social engineering can turn simple tasks into credential theft and remote compromise

A website promising to remove backgrounds from selfie photos is actually just dropping infostealing malware on people’s computers, security researchers are saying.