New OXLOADER Loader Uses Malicious Google Ads to Deliver Castle Stealer
Summary: Elastic Security Labs disclosed a campaign, codenamed REF8372, that uses malicious Google Ads to redirect searches such as "lts version of node.js" to a fake site hosting a batch script on Storj, which installs a previously unreported loader called OXLOADER and delivers the CastleStealer .NET information stealer. The loader uses control-flow flattening, opaque predicates, mixed Boolean-Arithmetic obfuscation, self-modifying decryption stubs, and abuse of the Windows .reloc section, and the advertiser account was removed from Google on May 14, 2026.
What's compelling: Elastic reports low detection rates across static engines and detonation runs, giving OXLOADER a window to operate before it gets hunted down - and the campaign's CIS-region exclusions point to a financially motivated, likely Russian-speaking actor.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026