‘What started as someone potentially trying to remove the background from a selfie ended with a custom .NET stealer rifling through their browser passwords’: Experts warn that free image editor tool could actually be dangerous malware

• A fake photo tool ranked high in search results tricks users into running malware via ClickFix tactics
• Victims first get infected with CastleLoader, which then deploys NetSupport RAT and a custom CastleStealer
• The campaign highlights how SEO poisoning and social engineering can turn simple tasks into credential theft and remote compromise

A website promising to remove backgrounds from selfie photos is actually just dropping infostealing malware on people’s computers, security researchers are saying.

Cybersecurity experts at Huntress outlined how they discovered a website which, through SEO poisoning, managed to work its way to the top of search engine results pages. Therefore, when people search for background removal tools, there is a good chance they’ll land on this particular, malicious site.