Kiran 
A C#-based infostealer first spotted in April 2026 is maturing fast. Flashpoint’s latest analysis shows CastleStealer can now break Chrome’s app-bound encryption, run remote commands, and send stolen data in small encrypted pieces designed to avoid network alarms.
Flashpoint analysts say they have not yet seen a large wave of threat actors adopting CastleStealer. Even so, the speed at which its developers are adding features makes it one to watch.
CastleStealer first surfaced publicly in April 2026. Attackers used ClickFix social engineering to deliver a Python script, which launched a loader called CastleLoader.
CastleStealer Infostealer Bypasses Chrome App-Bound Encryption
By June, the delivery method had shifted. Malicious advertisements steered victims to fake Node.js installation sites, where a batch script posing as an installer downloaded a newer loader, OXLOADER.
OXLOADER makes analysis harder through repeated self-decryption, obfuscated API resolution, sandbox checks, and in-memory execution. Flashpoint assesses that the loaders appear to be developed in-house, suggesting considerable anti-analysis and stealth skill.
On execution, CastleStealer checks the system’s MUI languages for Russian (ru-RU). It then contacts its command-and-control server, sends a handshake containing its build UUID and basic host details, and uploads further system information.
For Chromium-based browsers, it collects login data, cookies, browsing history, web data, and extension information, including extension IDs, IndexedDB data, and extension storage. It also takes Firefox logins, cookies, history, and form history.
Beyond browsers, the stealer targets Steam files such as config.vdf, loginusers.vdf, and local.vdf. It searches APPDATA for Discord and Telegram directories. It also sweeps the file system broadly, skipping some file types and anything containing “backup,” while prioritizing files with “wallet” in the name.
Early versions could not read data from updated browsers protected by app-bound encryption. Newer samples now use Chrome’s IElevator COM interface to get around that control, a method other modern infostealers also use.
The change removes a meaningful limitation. Credentials and session data that were once out of reach are now exposed on up-to-date browsers.
The malware now has basic remote shell functionality. An operator can send a shell command, supply a file to execute, or provide a URL for another payload that CastleStealer downloads and runs.
This turns a one-shot data theft into a foothold. Attackers can interact with the infected machine and deploy additional malware afterward.
Many infostealers bundle loot into one archive and ship it to a C2 server or Telegram channel. CastleStealer instead sends smaller chunks over raw TCP, encrypted with AES.
Each packet follows a simple layout: a 4-byte size, an AES IV, then the encrypted data. Flashpoint’s analysts assess that this approach helps avoid detections triggered by one large outbound transfer. When finished, the malware deletes itself using a common ping-delay technique.
Mitigation
The sample’s behavior suggests several practical checks for security teams:
- Treat fake software installers promoted through ads, especially Node.js lookalikes, as a likely entry point.
- Warn staff about ClickFix prompts that ask them to paste commands.
- Monitor for unusual raw TCP traffic made of small, regular encrypted packets.
- Watch for unexpected access to Chrome’s elevation COM interfaces.
- Reset credentials and revoke sessions on any machine that may have been exposed.
CastleStealer’s path from a limited stealer to a remote-controlled tool shows how quickly a young malware family can mature. Its developers are clearly investing in it, and defenders should track it before adoption grows.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
George antony 
