New OXLOADER Loader Uses Malicious Google Ads to Deliver CastleStealer

Cybersecurity researchers from Elastic Security Labs have disclosed a new campaign that delivers the CastleStealer information stealer via a previously unreported malware loader named OXLOADER. The campaign, codenamed REF8372, leverages malicious Google Ads as an initial infection vector.

The attack begins when users search for terms like “lts version of node.js” on Google, which redirects them to a fake website (node-js[.]prentiva99[.]info) promoted through bogus ads under the verified advertiser name “ВОЛОДИМИР ТЕРЕЩЕНКО,” purportedly based in Ukraine. The advertiser account and its campaigns were removed from Google on May 14, 2026.

Users who interact with the fake site are served a batch script hosted on Storj, a decentralized cloud storage platform. The script displays a fake installation wizard UI while stealthily downloading OXLOADER via PowerShell and executing it with elevated privileges. The attack then uses DLL side-loading to launch a rogue DLL that decrypts and executes the CastleStealer payload.

OXLOADER employs advanced obfuscation techniques including control-flow flattening, opaque predicates, mixed Boolean-Arithmetic, self-modifying decryption stubs, and abuse of the Windows .reloc section to stage shellcode. It also includes anti-VM measures to evade sandbox analysis. CastleStealer is a .NET information stealer previously distributed alongside CastleLoader in a campaign called BackgroundFix, attributed to the threat cluster GrayBravo.

Elastic Security Labs assesses the threat actor is likely Russian-speaking and financially motivated, as the malware includes exclusions to prevent infecting machines in the CIS region. The researchers note that OXLOADER is in an early operational phase but its sophisticated engineering suggests it is worth monitoring.