CastleStealer targets Discord and Telegram session files and Steam account credentials

Duo Tech@duotech

•updated Jul 16, 2026•1•0•2

Detects unauthorized access attempts to session files and account credentials stored locally by Discord, Telegram, and Steam applications, a behavior consistent with the CastleStealer malware.