The protection of Chromium ceased to be an insurmountable barrier for CastleStealer. New malware samples have learned to bypass browser protection and leave the operators with a channel for remote control of the infected computer. Flashpoint detected changes in the analysis of fresh versions of the program, first publicly seen in April 2026.
The main update concerns the protection of browser secrets. Early variants of CastleStealer could not extract data closed by the App-Bound Encryption mechanism, which links the decryption of cookies and saved accounts with the browser itself. Now the malware turns to the COM-interface IELevator in Chrome and gets access to information that previously remained unavailable.
After launch, CastleStealer collects logins, cookies, visit history, web data and information from Chromium browser extensions. In Firefox, the malware searches for credentials, cookies, history and information from forms. In addition, the program checks Steam files, Discord and Telegram directories, and among the documents is especially actively looking for names with the word “wallet” indicating crypto wallets.
The new versions also received a basic remote shell. The operator can send a system command, transfer the file to run, or specify the address of the additional load that CastleStealer will download and execute. As a result, the infostiller ceases to be a tool for one-time data theft and can serve as a point of further access to the already compromised system.
The way the information is withdrawn has also changed. Instead of one large archive, CastleStealer sends small portions of data directly over TCP and encrypts traffic with AES. The package contains a four-byte size field, an initialization vector and encrypted data. Flashpoint estimates that the crushing of transmission can reduce noticeable bursts of network traffic, although the encryption itself does not make the exchange invisible.
The developers simultaneously complicate the delivery chain. In the spring, CastleStealer was distributed through ClickFix and CastleLoader, and in the summer appeared in the campaign with fake advertising Node.js and the OXLOADER downloader. The latter decrypts its own code several times, hides access to the API, checks the sandboxes and launches the components in the memory, making automatic analysis difficult.
Despite the development of functions, Flashpoint does not yet see a mass transition of intruders to CastleStealer. However, the malware has already eliminated one of the previous restrictions, received remote execution of commands and more hidden sending of stolen information. After completing the work, the program removes its own file through a ping-latency technique, reducing the number of artifacts on the infected machine.
The main update concerns the protection of browser secrets. Early variants of CastleStealer could not extract data closed by the App-Bound Encryption mechanism, which links the decryption of cookies and saved accounts with the browser itself. Now the malware turns to the COM-interface IELevator in Chrome and gets access to information that previously remained unavailable.
After launch, CastleStealer collects logins, cookies, visit history, web data and information from Chromium browser extensions. In Firefox, the malware searches for credentials, cookies, history and information from forms. In addition, the program checks Steam files, Discord and Telegram directories, and among the documents is especially actively looking for names with the word “wallet” indicating crypto wallets.
The new versions also received a basic remote shell. The operator can send a system command, transfer the file to run, or specify the address of the additional load that CastleStealer will download and execute. As a result, the infostiller ceases to be a tool for one-time data theft and can serve as a point of further access to the already compromised system.
The way the information is withdrawn has also changed. Instead of one large archive, CastleStealer sends small portions of data directly over TCP and encrypts traffic with AES. The package contains a four-byte size field, an initialization vector and encrypted data. Flashpoint estimates that the crushing of transmission can reduce noticeable bursts of network traffic, although the encryption itself does not make the exchange invisible.
The developers simultaneously complicate the delivery chain. In the spring, CastleStealer was distributed through ClickFix and CastleLoader, and in the summer appeared in the campaign with fake advertising Node.js and the OXLOADER downloader. The latter decrypts its own code several times, hides access to the API, checks the sandboxes and launches the components in the memory, making automatic analysis difficult.
Despite the development of functions, Flashpoint does not yet see a mass transition of intruders to CastleStealer. However, the malware has already eliminated one of the previous restrictions, received remote execution of commands and more hidden sending of stolen information. After completing the work, the program removes its own file through a ping-latency technique, reducing the number of artifacts on the infected machine.
