OXLOADER Uses MBA Obfuscation and Control

Gbhackers •Mayura Kathir • June 22, 2026

A previously undocumented Windows loader, tracked as OXLOADER, that combines sophisticated obfuscation and unconventional staging to evade static detection and sandbox analysis while delivering the new CASTLESTEALER infostealer via malvertising. The campaign leveraged malicious Google Ads impersonating Node.js and API Monitor, redirecting victims through intermediary domains to Storj-hosted batch scripts that download and execute OXLOADER […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

OXLOADER Malware Loader Delivers CASTLESTEALER via Malicious Google Ads A new Windows loader named OXLOADER is delivering the CASTLESTEALER infostealer through malicious Google Ads. This previously undocumented malware employs advanced obfuscation techniques and abuses the Windows .reloc section to evade detection. Victims searching for Node.js were redirected to a fake landing page, leading to a batch script hosted on Storj that executed OXLOADER. The threat actor is believed to be a financially motivated Russian-speaking group, with the campaign targeting users in the CIS region. The malicious ads were removed from Google on May 14, 2026, but the threat remains active. The loader uses multiple anti-VM checks and sophisticated code-hiding techniques to avoid detection by security tools. 4 sources 71

Extracted Entities

OXLOADER Uses MBA Obfuscation and Control

The full story

Extracted Entities

Attack Types (1)

Malware (2)

MITRE ATT&CK (3)

Platforms (2)

Tools (2)