CastleStealer Malware Bypasses Chromium ABE and Adds Remote Command Execution Capabilities

CastleStealer is an actively developed C# information stealer that has expanded from credential harvesting to include sophisticated in-house loaders (e.g., OXLOADER), ABE bypass for Chromium via the IElevator COM interface, a simple remote shell for post-compromise control, and encrypted small TCP transfers for exfiltration; distribution observed via social-engineered Python loaders and fake Node.js installers, but Flashpoint has not seen widespread adoption.