Velvet Tempest Stages DonutLoader and CastleRAT via ClickFix Campaign

Velvet Tempest staged DonutLoader and retrieved the CastleRAT backdoor via a ClickFix malvertising campaign.

Part of the PlainSec briefing for 2026-03-08

Sources