CastleStealer malware adds browser bypass and remote shell capabilities
Flashpoint analysis reveals CastleStealer can now bypass Chromium encryption and execute remote commands on compromised Windows systems.
Key points
- CastleStealer now bypasses Chromium App-Bound Encryption to steal protected browser data.
- The malware includes a remote shell feature allowing operators to run commands on victim devices.
- Delivery methods shifted from ClickFix campaigns to malicious Google ads targeting Node.js users.
Flashpoint analysts report that CastleStealer, a C#-based information stealer, has gained significant new capabilities. The malware now bypasses browser protections and provides a remote shell, expanding attacker access to compromised Windows systems.
The updated samples can extract data secured by Chromium’s App-Bound Encryption. Operators can run commands on victim devices, download additional payloads, and exfiltrate stolen information via small encrypted transmissions. This approach avoids detection by splitting data rather than sending large archives.
Evolution of Capabilities and Delivery
CastleStealer was first publicly identified in April 2026 within a ClickFix campaign. Victims were deceived into running a Python script that launched CastleLoader. By June, the distribution method changed significantly.
Malicious Google ads targeting users searching for Node.js directed them to fake installer websites. These sites delivered a batch file and the OXLOADER malware loader. Cyber Security News previously reported that OXLOADER placed CastleStealer directly into memory. This technique made the infection chain harder for traditional file-based security tools to detect.
Data Collection and Remote Access
Analysts at Flashpoint noted that CastleStealer developers have improved both data collection and post-compromise operations. The malware can now function as a basic remote access tool. This creates a route for further malware delivery or hands-on activity on the same machine.
Upon execution, CastleStealer checks if the Windows Multilingual User Interface language is set to Russian. It then contacts its command-and-control server, sending a build UUID and basic device details. The malware proceeds to gather extensive information about the host system.
The stealer targets Chromium-based browsers for login data, cookies, browsing history, web data, and extension details. It also collects IndexedDB content and extension storage. Firefox data is similarly targeted, including login credentials, cookies, history, and form history.
Beyond browsers, CastleStealer searches for Steam files such as config.vdf and loginusers.vdf. These files may contain account details and settings. The malware also scans APPDATA directories linked to Discord and Telegram.
Local file searches focus on filenames containing “wallet,” while excluding specific file types and files with “backup” in the name. Despite these improvements, Flashpoint analysis indicates CastleStealer has not yet reached the broad usage levels of major established stealer families.
What should you do?
Security teams should monitor for unusual outbound network traffic patterns, particularly small encrypted transmissions. Endpoint detection solutions should be configured to alert on memory-resident processes that lack associated files. Administrators should verify that browser data encryption features are enabled and functioning correctly.
What to do and how to stay safe: CastleStealer
- Monitor network logs for small, frequent encrypted outbound connections that may indicate data exfiltration.
- Configure endpoint detection to flag processes running in memory without corresponding disk files.
- Verify that Chromium-based browsers have App-Bound Encryption enabled to protect stored credentials.
- Review Google Ads click logs for unexpected redirects to unofficial software installer sites.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How does CastleStealer bypass browser security?
The malware can collect browser data protected by Chromium’s App-Bound Encryption, allowing it to access stored credentials and cookies.
How is CastleStealer delivered to victims?
It was initially delivered via ClickFix campaigns using Python scripts, but later shifted to malicious Google ads that distribute OXLOADER.
What data does CastleStealer target?
It targets browser login data, cookies, history, Steam configuration files, and Discord and Telegram APPDATA directories.
