Blackpoint SOC Threat Pulse: Week of August 17, 2026

In this week’s Threat Pulse, the Blackpoint Security Operations Center (SOC) recaps a ClickFix-style attack that tricked a user into running a command that pulled a DLL loader for AcrStealer, an information-stealing malware family, directly from an attacker-controlled server. The Adversary Pursuit Group (APG) is also tracking an evolving campaign using ClickFix-style attacks and fake AMD/Intel updates to deploy CastleRAT. Last week, the Blackpoint APG released a notice covering two critical SAP vulnerabilities, including one with a perfect 10.0 CVSS score, that is now being actively targeted in the wild. 

Executive Summary

• A ClickFix-style social engineering attack tricked a user into running a command that pulled a malicious DLL loader from an attacker-controlled WebDAV server and launched it using rundll32. The DLL was identified as a loader for AcrStealer, an information-stealing malware family. 
• The Blackpoint SOC isolated the host immediately after detecting the suspicious command execution, stopping the infection before credentials or data could be exfiltrated. 
• This week’s snapshot includes more than 165 incidents, with 84% disrupted before payload deployment. 
• The Blackpoint APG is tracking an evolving campaign using ClickFix-style attacks and fake AMD/Intel software updates to deploy a loader, increasingly followed by CastleRAT as a secondary payload. Blackpoint has observed 47 incidents since mid-June, including 13 confirmed CastleRAT deployments, with 100% interrupted before the attackers could establish a further foothold. 
• The Blackpoint APG also issued a threat notice this week covering two critical SAP vulnerabilities.  
• CVE-2026-58231 is a maximum-severity authorization flaw in SAP Commerce Cloud with a CVSS score of 10.0 that requires no user interaction and is already being exploited to execute arbitrary code.  
• CVE-2026-34265 is a critical memory corruption flaw in SAP NetWeaver and ABAP Platform with a CVSS score of 9.8, though exploitation has not yet been confirmed. 

Featured Incident 

DLL-ightfully Denied 

What we’re seeing 

• Blackpoint SOC alerted to suspicious cmd.exe usage by a user on a host; further investigation revealed this was likely due to a ClickFix-style attack.  

• The command used cmd.exe to pull a second-stage DLL from an attacker-controlled WebDAV server and launch it via rundll32. 

• Further analysis identified the payload as a loader for AcrStealer, an information-stealing malware family. 

What the Blackpoint SOC did 

• The Blackpoint SOC isolated the host immediately upon detecting the suspicious command execution.  

• Conducted further analysis related to the activity to identify the payload. 

Why this matters 

• ClickFix-style social engineering skips file-based detection entirely by tricking the user to run the payload themselves.  

• The Blackpoint SOC identified the behavior and stopped an information stealer infection before any credentials or data could be exfiltrated.  

BROC Weekly Snapshot

What changed. What didn’t. What matters.

Incidents Observed  >165↑

Pre-Payload Disruptions  84%

Pre-Ransom Interruptions  2%

Campaign Statuses 

Fake CAPTCHA/ClickFix	↓	Ongoing	23%
Rogue RMM	↑	Ongoing	22%
Trojanized Installers	↑	Ongoing	5%
SSL VPN Compromise	↓	Ongoing	4%
Fake Update	↑	Ongoing	4%

Quick Take 

The Blackpoint APG tracks the evolution of active malware campaigns as they shift infrastructure, payloads, and delivery methods. The Blackpoint APG is currently tracking a campaign that uses ClickFix-style lures fake AMD/Intel software updater prompts to trick users into executing a malicious loader. In a growing number of cases, the loader has been observed dropping CastleRAT as a secondary payload.  

Since mid-June 2026, the Blackpoint SOC has identified and responded to 47 incidents tied to this campaign, with 13 confirmed to have deployed CastleRAT as an additional payload. 100% of these incidents were interrupted before the loader could establish a further foothold. Because payload behavior varies across campaign iterations, the Blackpoint APG continues to cluster and re-evaluate incidents individually rather than assume a single fixed toolset.