Loading malware…
CastleStealer is a C#/.NET information stealer targeting Windows systems, with newer variants also providing remote shell functionality. It harvests credentials, cookies, browsing history, form data, and other browser information from Chromium-based browsers and Firefox. Its collection scope includes browser-extension storage, cryptocurrency wallet data, Discord and Telegram session data, Steam account information, and local files, with particular attention to wallet-related files.
Newer variants bypass Chromium App-Bound Encryption by abusing the browser's IElevator COM interface, enabling access to protected browser data that earlier versions could not decrypt. CastleStealer gathers host information and registers with its command-and-control infrastructure using a build identifier and device details. It exfiltrates collected information over raw TCP in multiple smaller AES-encrypted transmissions rather than a single large archive. Its remote shell allows operators to execute commands, supply files for execution, and download and execute additional payloads. Samples include Russian-locale exclusion checks, and the malware can delete itself after completing its activity.
CastleStealer has been distributed through CastleLoader in ClickFix campaigns and through OXLOADER in malvertising campaigns using malicious Google Ads and fake Node.js installer websites. Other CastleLoader delivery chains have used fake software-update lures and in-memory execution. The financially motivated, Russian-speaking threat actor UAT-11795 also deploys CastleStealer through Starland RAT as a follow-on payload in campaigns using trojanized software installers. These operations have primarily affected users in the United States, with additional activity in Europe and elsewhere, and emphasize credential and cryptocurrency-related theft rather than a single industry.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Depending on operator objectives, Starland RAT can deploy CastleStealer, Remcos RAT, or the previously undocumented WLDR framework.
22 distinct techniques documented for this family, organized by ATT&CK tactic.
An obfuscated PowerShell stager was uploaded to VirusTotal on June 18, 2026. The Urutyka campaign follows CastleLoader’s established infection chain... The obfuscated PowerShell stager unpacks a second PS1 script and contacts the download server...
The downloaded MSI file executes a .bat file that launches a embedded IronPython installation... The python3 script downloads another python script from the C2 server that is responsible for injecting CastleLoader’s stage 2 shellcode.
The next-stage shellcode is a payload configured from DonutLoader ... used to wrap .NET assemblies, DLLs, and EXEs into position-independent shellcode.
6ca7a458985350ac082a9c9820d7f8d39128a4c4bda2f5d32f169a45b7b22bc6 MobaXterm_v26.1.exe ... 6ae334ce60d1a9b7fb96d1d0d0eda5ec7c2c31d3f0cf3e4d7e3056504d50043d WebEx_Client.exe ... 1a01ad25712d306f27f526332fdccf959f2de53207b54e4e80f60faa804d6cb6 FaceitInstaller_x64.exe ... f4491736743a16f1278b8ba01649ee93343764e35ae5e1c0d5e0c0e1d7e32c14 Zoom Installer
After registration, the RAT polls its C2 server approximately every 50 to 60 seconds and supports execution of shell commands, process injection of both 32-bit and 64-bit shellcode, and delivery of additional executable payloads.
These loaders resolve Windows APIs dynamically, bypass both the Antimalware Scan Interface (AMSI) and Event Tracing for Windows (ETW), decrypt embedded payloads in memory, and execute them using reflective loading or PowerShell Runspaces.
Before any network activity, Starland checks whether it’s running in a sandbox. It compares the logged-on username against a hardcoded list of known sandbox service accounts... then checks the computer name against hostnames from Cuckoo, Any.Run, Joe Sandbox, and Hybrid Analysis.
The actor further supports operations with CastleStealer, a .NET infostealer targeting credentials and crypto wallets...
CastleStealer ... enumerates crypto wallet browser extensions, Discord and Telegram session files
Starland RAT performs extensive host reconnaissance, collecting hardware identifiers, operating system details, Active Directory information, installed antivirus products, desktop screenshots, and the presence of more than 40 cryptocurrency wallet applications and browser extensions.
Before any network activity, Starland checks whether it’s running in a sandbox. It compares the logged-on username against a hardcoded list of known sandbox service accounts... then checks the computer name against hostnames from Cuckoo, Any.Run, Joe Sandbox, and Hybrid Analysis.
70 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
C#-based Windows information stealer that collects Chromium and Firefox credentials, cookies, history, and other browser data, along with Steam account files, Discord and Telegram application data, and local files associated with wallets. Newer samples abuse Chrome's IElevator COM interface to bypass Chromium App-Bound Encryption. Remote shell capabilities allow operators to execute commands and files, download additional payloads, and conduct follow-on activity. Stolen data is transmitted in small AES-encrypted chunks over raw TCP, and the malware deletes itself using a ping-delay technique. The reported delivery chains involve ClickFix social engineering and fake Node.js installers promoted through malicious advertisements.
C#-based information stealer first publicly identified in April 2026. It collects browser credentials, cookies, history, form data, and extension storage; Steam account-related files; data associated with Discord and Telegram; and local files, emphasizing filenames containing 'wallet'. It checks system MUI languages for Russian and sends its build UUID and host information to its C2. Newer samples bypass Chromium app-bound encryption using Chrome's IElevator COM interface and support remote shell commands, file execution, and downloading and executing additional payloads. Stolen data is transmitted in small AES-128-CBC-encrypted packets over raw TCP, potentially reducing conspicuous transfer spikes. It deletes itself after completing its activity. Distribution has involved ClickFix social engineering and malicious advertisements leading to fake Node.js installer websites.
An additional payload deployed in the campaign via custom shellcode loaders, likely used for theft of victim data as part of the actor's credential and cryptocurrency-focused objectives.
A .NET infostealer delivered in CastleLoader-linked campaigns. In the Garrigin and Noidret campaigns it is installed as a downstream payload, including via a C/C++ injector that stores the .NET assembly in the .data segment and injects it into memory.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.