Flashpoint Report: CastleStealer Now Evades Chromium Encryption and Runs Remote Commands
New analysis shows the C# stealer has added remote execution, bypasses browser encryption, and uses encrypted TCP for data exfiltration.
Key points
- CastleStealer samples now bypass Chromium app-bound encryption to harvest saved credentials.
- The malware supports remote command execution and transmits data via small, encrypted TCP packets.
- Flashpoint analysts report no widespread adoption by threat actors despite these new capabilities.
Flashpoint researchers have identified significant capability upgrades in CastleStealer, a C# information-stealing malware first seen in April 2026. According to a report shared with GBHackers, the tool now bypasses Chromium’s app-bound encryption and supports remote command execution, moving beyond simple credential theft.
The latest samples analyzed by Flashpoint exhibit sophisticated evasion techniques. Instead of uploading a single large archive of stolen data, the malware now transmits information through small, encrypted TCP exchanges. This change in data handling makes detection more difficult, as network traffic appears as low-volume, encrypted communication rather than a bulk upload to a command-and-control server.
Loader Sophistication and Delivery
CastleStealer’s delivery mechanism has also evolved, according to the Flashpoint assessment. Early activity relied on ClickFix social engineering to drop a Python script that executed CastleLoader. More recent variants use a batch script disguised as an installer to download and execute OXLOADER.
OXLOADER represents a significant increase in technical complexity. Flashpoint notes that this newer loader incorporates multiple self-decryption stages, obfuscated API resolution, sandbox checks, and in-memory execution. The researchers assess that these loaders were developed in-house by the CastleStealer operators, demonstrating substantial proficiency in stealth and anti-analysis techniques.
Operational Scope and Targeting
Upon execution, CastleStealer performs a language check on the system’s Multilingual User Interface settings. It specifically looks for the Russian locale, identified as ru-RU, before establishing contact with its command-and-control infrastructure. The malware transmits a handshake containing its build UUID and basic host information, followed by additional machine details.
The collection routines are extensive. For Chromium-based browsers, the stealer targets saved logins, cookies, browsing history, web data, and browser-extension information. This includes extension identifiers, IndexedDB databases, and extension storage. For Firefox, it harvests credentials, cookies, browsing history, and form history.
Who Is Affected
Beyond browser data, CastleStealer targets specific application files and directories. It collects Steam configuration files, including config.vdf, loginusers.vdf, and local.vdf. The malware also searches the APPDATA directory for Discord and Telegram folders, likely to harvest chat logs or account information stored there.
File harvesting logic includes specific exclusions and inclusions. The malware ignores certain file types and any filenames containing the word “backup.” Conversely, it prioritizes files with names containing “wallet,” indicating a focus on cryptocurrency assets. This scope aligns with the broader infostealer threat landscape, which typically targets credentials, browser artifacts, financial information, and crypto-related data.
What should you do?
Flashpoint has not observed widespread adoption of these new CastleStealer capabilities among threat actors. However, the researchers emphasize that the malware’s continuing development and sophisticated loaders make it an emerging threat. Operators are refining both initial delivery and payload capabilities, with loader protections complicating inspection before the stealer begins collecting information.
Background: Social engineering
Look for urgency, secrecy, and deviation from standard channels. Verify identity through a separate, known communication path before acting. Isolate suspicious interactions immediately to prevent lateral movement within your network environment.
Read the full guide: Social Engineering Warning Signs and How to Respond
What to do and how to stay safe: CastleStealer
- Monitor network traffic for unusual outbound TCP connections, particularly small, encrypted packets that do not correspond to known legitimate services.
- Inspect executable files and batch scripts for signs of obfuscation or self-decryption routines, which are characteristic of the OXLOADER component.
- Check system logs for execution of Python scripts or PowerShell commands initiated by user profiles following social engineering attempts.
- Review browser extension storage and IndexedDB databases for unauthorized access, as CastleStealer targets these specific data stores.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does CastleStealer target all languages?
No, the malware checks for the Russian locale (ru-RU) in the system’s Multilingual User Interface settings before proceeding with its routine.
Is CastleStealer currently widespread?
Flashpoint analysts have not observed widespread adoption of the malware among threat actors, though they note it is an emerging threat due to its development.
What new capabilities have been added to CastleStealer?
The malware now bypasses Chromium app-bound encryption, supports remote command execution, and transmits stolen data via small, encrypted TCP exchanges.
