CastleStealer Malware Uses Browser Protection Bypass and Remote Shell to Expand Attacker Access

Cybersecuritynews •Tushar Subhra Dutta • October 9, 2026

CastleStealer, an emerging C#-based information stealer, has added browser protection bypass and remote shell features that give its operators a wider path into compromised Windows systems. The newer malware samples can collect browser data protected by Chromium’s App-Bound Encryption, run commands on a victim device, download extra payloads, and move stolen information through small encrypted […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CastleStealer Malware Enhances Capabilities with Remote Shell and Browser Bypass CastleStealer, a C# information stealer first identified in April 2026, has evolved to include remote command execution and the ability to bypass Chromium's App-Bound Encryption (ABE). New samples can collect sensitive browser data, execute commands on compromised systems, and exfiltrate stolen information via small encrypted transmissions. Flashpoint reports that while CastleStealer has not seen widespread use among threat actors, its ongoing development and sophisticated techniques indicate it poses a growing risk. The malware employs advanced loaders like OXLOADER, which utilize anti-analysis techniques, making detection challenging. CastleStealer targets saved logins, cookies, and browsing history from both Chromium and Firefox browsers, as well as configuration files from applications like Steam, Discord, and Telegram. The malware's operators have refined their delivery methods, complicating inspection before data collection begins. Flashpoint emphasizes the need for vigilance as CastleStealer continues to develop. 2 sources 51

Extracted Entities

CastleStealer Malware Uses Browser Protection Bypass and Remote Shell to Expand Attacker Access

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (2)

Platforms (1)