Back Thehackernews

New OXLOADER Loader Uses Malicious Google Ads to Deliver CastleStealer

Thehackernews •[email protected] (The Hacker News) • June 22, 2026

Learn how to uncover hidden AI use, see what data it can access, map every AI action to a human owner, and apply practical governance without heavy infrastructure changes.

Learn how to contain Mythos-style AI attacks with practical Zero Trust controls that reduce exposure, stop lateral movement, and limit risk.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

OXLOADER Malware Loader Delivers CASTLESTEALER via Malicious Google Ads A new Windows loader named OXLOADER is delivering the CASTLESTEALER infostealer through malicious Google Ads. This previously undocumented malware employs advanced obfuscation techniques and abuses the Windows .reloc section to evade detection. Victims searching for Node.js were redirected to a fake landing page, leading to a batch script hosted on Storj that executed OXLOADER. The threat actor is believed to be a financially motivated Russian-speaking group, with the campaign targeting users in the CIS region. The malicious ads were removed from Google on May 14, 2026, but the threat remains active. The loader uses multiple anti-VM checks and sophisticated code-hiding techniques to avoid detection by security tools. 4 sources 71

Extracted Entities

New OXLOADER Loader Uses Malicious Google Ads to Deliver CastleStealer

The full story

Extracted Entities

Attack Types (1)

Malware (2)

Platforms (1)