CastleStealer shows how infostealers are adding browser bypass

At a glance

What this is: Flashpoint examines CastleStealer, an emerging infostealer that is expanding beyond collection into browser protection bypass, remote command execution and stealthier exfiltration.

Why it matters: It matters because infostealers increasingly threaten human and non-human identity estates by harvesting browser-stored credentials, session material and app data that can be reused for access.

Context

CastleStealer sits in a familiar but still poorly governed risk space: infostealers are built to harvest browser data, application secrets and other locally stored information that can be reused for access. When they begin bypassing browser protections and adding remote command capability, the issue moves beyond simple credential theft into broader identity compromise and post-infection control.

For IAM and NHI programmes, this matters because stolen browser sessions, cookies, tokens and app credentials often become the bridge from a user device into cloud apps, developer tooling and downstream service access. The article shows an attacker workflow that is still common in endpoint-driven compromise, but the control failure now extends into identity governance, browser security and detection of unusual exfiltration patterns.

Key questions

Q: What breaks when infostealers collect browser tokens and saved credentials?

A: What breaks is the assumption that compromise stays on the endpoint. Browser tokens, saved passwords, and cookies are often enough to impersonate users or sessions elsewhere, which means theft becomes reusable access. Teams should assume stolen identity artefacts may move directly into SaaS, cloud, and admin workflows unless they are rapidly revoked or invalidated.

Q: Why do infostealers create such high identity risk?

A: They harvest reusable access material instead of forcing a new login. Cookies, saved passwords, tokens, and secrets often outlive the malware event itself, so the attacker can reuse them from elsewhere. This is why identity teams need to treat endpoint compromise as a direct threat to session and secret integrity.

Q: How do security teams spot stealthier infostealer exfiltration?

A: Look for repeated encrypted outbound connections with small payloads, unusual raw TCP use and host activity that ends in self-deletion. Those patterns can hide the burst behaviour many legacy detections depend on. Effective monitoring combines endpoint process context with network behaviour so that low-volume exfiltration still stands out.

Q: Should organisations treat infostealer detections as account compromise events?

A: Yes. If a stealer has accessed browser data, organisations should assume account compromise until sessions are revoked and exposed secrets are rotated. The practical test is whether the infected host had access to SaaS, developer portals or admin consoles. If so, response must include identity containment, not just malware removal.

Technical breakdown

Browser data collection and protection bypass

CastleStealer collects login data, cookies, browsing history, web data and extension storage from Chromium-based browsers, then expands to Firefox and other locally stored files. The key technical shift is its use of Chrome's IElevator COM interface to bypass app-bound encryption, which is intended to stop other processes from reading protected browser data. That means the stealer is no longer limited to older browser states or weaker profile protection. Once a browser protection layer can be bypassed from the same host, the attacker gains a much richer identity and session foothold than password theft alone would provide.

Practical implication: treat browser-stored session material as a governed access surface, not just endpoint residue.

Remote shell and payload delivery after compromise

Newer samples include basic remote shell functionality, allowing an operator to send commands, run a file, or deliver a URL for another payload. That changes CastleStealer from a one-time extractor into a post-compromise control channel. Even limited shell capability lets an attacker test the environment, stage tools or extend the intrusion when the first stolen artefacts are not enough. In operational terms, the stealer now behaves more like an access broker than a pure data thief, because the compromise can be reused for follow-on actions on the same host.

Practical implication: detect infostealer infections as potential staging events, not isolated data-loss incidents.

Encrypted small-batch exfiltration over raw TCP

CastleStealer no longer relies on a single archive transfer to a clear destination such as a Telegram channel. Instead, it sends smaller encrypted transmissions over raw TCP with AES-128-CBC wrapping, using a simple packet structure that reduces the visibility of the stolen content in transit. This matters because many detections are built around bursty outbound transfers, obvious upload destinations or repeated archive signatures. Splitting the exfiltration into smaller packets lowers the chance that perimeter or cloud egress controls will see a single obvious spike, especially when the malware also self-deletes after completion.

Practical implication: add network detections for encrypted low-volume exfiltration, not just large file transfers.

Threat narrative

Attacker objective: Steal browser and application data, preserve access to the infected host, and create a reusable foothold for further compromise and exfiltration.

1. Entry begins with social engineering and fake installer delivery, including ClickFix-based execution and malicious advertising that leads victims to a Node.js-themed lure.
2. Credential and session material are harvested from browser stores, extension data, application files and wallet-related local files, while newer samples bypass browser app-bound encryption.
3. Post-compromise, the operator can issue remote shell commands or deliver additional payloads to extend access on the infected host.
4. Impact comes from stolen identity material and follow-on control that can support account reuse, deeper compromise and stealthier data theft.

Breaches seen in the wild

• Shai Hulud npm malware campaign: Shai Hulud campaign: npm malware exposed secrets on GitHub.
• Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

CastleStealer shows that infostealer risk is now an access problem, not only a data-loss problem. Browser cookies, login data and extension storage are identity artefacts, and once a stealer can bypass browser protections those artefacts become reusable access material. The governance gap is that many programmes still treat endpoint compromise and identity compromise as separate issues. Practitioners should treat browser-stored session data as part of the identity control surface.

Browser protection bypass is the named concept this class of malware is exploiting. App-bound encryption was designed to raise the cost of cross-process browser theft, but attacker tooling is already adapting to that control. That means defensive assumptions based on browser hardening alone are fragile unless they are paired with endpoint containment, identity telemetry and credential revocation paths. The control question is not whether the browser encrypts data, but whether an attacker can still convert a local compromise into usable identity material.

Raw-TCP encrypted exfiltration is a detection blind spot that many teams still underweight. When malware shifts from bulk archive transfer to small encrypted packets, network security tools need behavioural baselines rather than file-size thresholds. This is especially relevant where stolen browser data can seed cloud and SaaS access, because the breach may begin on the endpoint but end in identity abuse. Practitioners should align endpoint, browser and egress monitoring to the same incident model.

The addition of remote command capability turns a stealer into a post-compromise operator foothold. That changes incident priority because the infected host is no longer just a source of stolen material, it is a platform for subsequent action. This should push security teams to separate one-off credential theft from systems that allow interactive follow-on execution. The right lens is containment of a live access path, not only cleanup of malware files.

For identity governance, the article reinforces a simple point: stolen sessions are credentials. IAM and PAM teams often focus on issued secrets and privileged accounts, while infostealers target what users actually hold open in browsers and desktop apps. That creates a direct bridge into SaaS, developer portals and service consoles. Practitioners should extend lifecycle and revocation thinking to browser sessions, not just passwords and API keys.

From our research library:

• 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
• Read next: Infostealer Threat Guide

What this signals

Browser protection bypass is becoming the infostealer arms race's next control failure. Once attackers can read browser material that was supposed to be protected by app-bound encryption, the control boundary has moved from secret storage to attacker execution on the host. That should push teams to think about browser sessions as governed identity artefacts, not temporary convenience data.

43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec. The same concern applies here in a different form: browser-stored identity artefacts can be copied, replayed and reused at scale once malware reaches the endpoint.

Identity response and endpoint response need to converge faster. If a stealer can collect cookies, login data and extension storage, the incident is no longer just a malware cleanup task. Practitioners need revocation, reauthentication and telemetry across both the endpoint and the identity plane.

For practitioners

• Hunt for browser-stored identity artefacts Prioritise login data, cookies, extension storage and web data in your incident response and endpoint hunts, because those artefacts are what CastleStealer is built to reuse.
• Baseline encrypted low-volume exfiltration Build detections for small encrypted TCP transfers that repeat over time, rather than relying on single large uploads or known messaging destinations.
• Treat browser protection bypass as a compromise signal Flag any host evidence of app-bound encryption bypass or unusual browser COM interface use as a high-confidence indicator of active credential theft.
• Revoke sessions after infostealer detection Invalidate cookies, tokens and active browser sessions on any endpoint confirmed or suspected to be infected, then re-authenticate users and rotate exposed secrets.
• Watch for remote-shell follow-on activity Escalate any infostealer case that shows command execution or payload staging, because that indicates the malware is being used as a persistent operator foothold.

Key takeaways

• CastleStealer illustrates how infostealers are evolving from simple credential harvesters into post-compromise access tools.
• Its newer samples can bypass browser protections, issue remote commands and hide exfiltration in encrypted low-volume traffic.
• Teams should treat browser session material as a credential class and respond with revocation, containment and behavioural detection.

Key terms

• Infostealer: An infostealer is malware built to collect credentials, session material, tokens, and other authentication data from infected systems. In NHI programmes, the risk is not only theft but reuse, because harvested workload secrets can unlock cloud access long after the initial infection.
• App-bound encryption: App-bound encryption is a browser protection mechanism that ties certain protected data to a specific application context. Its purpose is to reduce cross-process theft of browser secrets, but it is only effective when attackers cannot bypass the local execution controls that guard the data.
• Session Material: Session material is the data that keeps an authenticated browser session alive, such as cookies, bearer tokens, and other reusable authentication artifacts. In NHI governance, session material matters because stealing it can bypass password and MFA controls without needing the original login flow.
• Encrypted low-volume exfiltration: Encrypted low-volume exfiltration is the practice of sending stolen data in small, wrapped packets rather than a single obvious transfer. It is used to reduce detection by network controls that rely on burst size, file signatures or known upload destinations.

Deepen your knowledge

NHI Foundation Level course covers NHI governance, machine identity security and secrets management through the industry's only accredited NHI security programme. It is designed for practitioners who need to connect identity controls to real-world compromise patterns.