Back Technadu

OXLOADER: New Windows Loader Drops CASTLESTEALER via Google Ads

Technadu • June 22, 2026

OXLOADER, a previously undocumented Windows loader, is delivering the CASTLESTEALER infostealer via Google Ads, evading static detection via the Windows .reloc section abuse, five anti-VM/language checks, and MBA obfuscation. Researchers say CIS-region exclusions point to a financially motivated, Russian-speaking threat actor.

OXLOADER reaches victims through malvertising via Google Ads. The same malware was delivered by masquerading as a Node.js installer and an API Monitor. Elastic Security Labs researchers are tracking the activity as REF8372.

For instance, targets searching for an LTS version of Node.js clicked a result leading to a fake landing page, then a Storj-hosted batch script that downloaded and launched the loader with a UAC elevation prompt.

The loader leans on heavy obfuscation to evade static detection, including control-flow flattening (CFF), mixed Boolean-Arithmetic (MBA), and opaque predicates. It runs five environment checks before proceeding:

For staging, OXLOADER abuses the Windows .reloc section to host shellcode and copies the DLL to a randomly named .ocx file. The stage is built with DonutLoader, which wraps the CASTLESTEALER infostealer (which Huntress recently discovered ) as position-independent code (PIC) for in-memory execution.

Last week, malicious Steam Workshop wallpapers were seen hijacking accounts via Wallpaper Engine to distribute DarkKomet, Lumma, Vidar, and RenEngine .

Early this month, an RAlord affiliate was reportedly banned for breaking CIS ransomware rules after infecting Eriell Group. May reports outlined that threat actors leveraged Google Ads and Claude.ai shared chats to distribute Mac malware.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

OXLOADER Malware Loader Delivers CASTLESTEALER via Malicious Google Ads A new Windows loader named OXLOADER is delivering the CASTLESTEALER infostealer through malicious Google Ads. This previously undocumented malware employs advanced obfuscation techniques and abuses the Windows .reloc section to evade detection. Victims searching for Node.js were redirected to a fake landing page, leading to a batch script hosted on Storj that executed OXLOADER. The threat actor is believed to be a financially motivated Russian-speaking group, with the campaign targeting users in the CIS region. The malicious ads were removed from Google on May 14, 2026, but the threat remains active. The loader uses multiple anti-VM checks and sophisticated code-hiding techniques to avoid detection by security tools. 4 sources 71

Extracted Entities

OXLOADER: New Windows Loader Drops CASTLESTEALER via Google Ads

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Companies (1)

Domains (1)

Malware (6)

MITRE ATT&CK (5)

Platforms (2)

Tools (2)