“What started as someone potentially trying to remove the background of a selfie ended with a custom .NET stealer digging into their browser passwords”: Experts warn free image editing tool could actually be dangerous malware.

• A fake photo tool ranking high in search results tricks users into running malware via ClickFix tactic.
• Victims are first infected by CastleLoader, which then deploys NetSupport RAT and a custom CastleStealer.
• The campaign highlights how SEO poisoning and social engineering can turn simple tasks into credential theft and remote compromise.

A website promising to remove the background from selfie photos is really just delivering information-stealing malware to users’ computers, security researchers say.

Cybersecurity experts at Huntress have explained how they discovered a website that, through SEO poisoning, managed to claw its way to the top of search engine results pages. Therefore, when people search for background removal tools, there is a high chance that they will land on this particular malicious site.