CastleStealer Malware Enhances Capabilities with Remote Command Execution

• •CastleStealer now includes remote command execution capabilities.
• •The malware can bypass app-bound encryption in Chromium browsers.
• •Exfiltration of stolen data occurs in small encrypted packets.

CastleStealer, a C# information-stealing malware first identified in April 2026, has evolved to include remote command execution and the ability to bypass app-bound encryption in Chromium-based browsers. Recent samples analyzed by Flashpoint show that it can now exfiltrate stolen data in small encrypted packets rather than a single large archive. The malware primarily targets credentials, cookies, and browsing history from browsers like Chrome and Firefox, as well as configuration files from applications like Steam, Discord, and Telegram. The malware employs sophisticated loaders, including OXLOADER, which utilize multiple self-decryption stages and anti-analysis techniques. Despite its advanced capabilities, Flashpoint notes that widespread adoption among threat actors has not yet been observed. The malware's operators continue to refine its delivery methods and payload functionalities, indicating a significant threat potential. Flashpoint has not confirmed any of CastleStealer at this time.