{"id":1399,"date":"2026-06-22T13:38:05","date_gmt":"2026-06-22T13:38:05","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=1399"},"modified":"2026-06-22T13:38:05","modified_gmt":"2026-06-22T13:38:05","slug":"new-oxloader-loader-uses-malicious-google-ads-to-deliver-castlestealer","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=1399","title":{"rendered":"New OXLOADER Loader Uses Malicious Google Ads to Deliver CastleStealer"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Jun 22, 2026<\/span><\/span>Malvertising \/ Endpoint Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Cybersecurity researchers have disclosed details of a new campaign that delivers CastleStealer by means of a previously unreported malware loader dubbed OXLOADER<\/b>.<\/p>\n

According to Elastic Security Labs, the campaign leverages malicious Google Ads as a starting point to distribute the malware. Evidence indicates that the threat actor is likely Russian-speaking and financially motivated, owing to the presence of explicit exclusions to prevent infecting machines located in the Commonwealth of Independent States (CIS) region. The campaign has been codenamed REF8372.<\/p>\n

\u00abThe loader uses several obfuscation layers (control-flow flattening, opaque predicates, mixed Boolean-Arithmetic), self-modifying decryption stubs, and abuses the Windows .reloc section to stage shellcode,\u00bb researchers Daniel Stepanic and Jia Yu Chan said<\/a> in a technical breakdown.<\/p>\n

The attack begins when unsuspecting users enter queries such as \u00ablts version of node.js\u00bb on search engines like Google, redirecting them to a fake website (\u00abnode-js[.]prentiva99[.]info\u00bb) surfaced via bogus ads published under the verified name \u00ab\u0412\u041e\u041b\u041e\u0414\u0418\u041c\u0418\u0420 \u0422\u0415\u0420\u0415\u0429\u0415\u041d\u041a\u041e\u00bb that’s purportedly based in Ukraine.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

It’s currently unknown if the advertiser account is linked to the actual threat actor, or if it’s a front account or a purchased identity. The advertiser account, along with its ad campaigns, was removed from Google on May 14, 2026.<\/p>\n

Users who end up interacting with the site are served a batch script hosted on Storj, a decentralized, open-source cloud storage platform. The abuse of Storj once again illustrates how threat actors continue to leverage legitimate services to evade domain-based reputation filters.<\/p>\n

\"\"<\/a><\/div>\n

Running the batch script displays a bogus installation wizard user interface (UI), while stealthily downloading a next-stage payload, a Storj-hosted executable<\/a> dubbed OXLOADER through a PowerShell command and executing it with -Verb RunAs to trigger a Windows User Account Control (UAC) prompt.\u00a0<\/p>\n

The attack then employs DLL side-loading to launch a rogue DLL, which then proceeds to decrypt and execute the CastleStealer payload. OXLOADER also makes use of techniques like control-flow flattening (CFF) and mixed Boolean-Arithmetic (MBA) to evade static detection, while also taking steps to ensure it’s not run on sandboxed environments.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

CastleStealer is a .NET information stealer that was recently distributed alongside CastleLoader through a ClickFix-style lure masquerading as a free image-editing tool as part of a campaign codenamed BackgroundFix. CastleLoader is attributed to a threat activity cluster known as GrayBravo.<\/p>\n

\u00abOXLOADER is in an early operational phase, but the engineering behind it suggests this family is worth watching,\u00bb Elastic said. \u00abThe code obfuscation, anti-VM measures, benign-looking code used to masquerade its binaries, and unique staging techniques reflect deliberate engineering choices to evade analysis.\u00bb<\/p>\n

\u00abThat investment is paying off, resulting in low detection rates across static engines and detonation runs, giving OXLOADER a window to operate before it gets hunted down.\u00bb<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\ue804Ravie Lakshmanan\ue802Jun 22, 2026Malvertising \/ Endpoint Security Cybersecurity researchers have disclosed details of a new campaign that delivers CastleStealer by means of a previously unreported malware loader dubbed OXLOADER. According…<\/p>\n","protected":false},"author":1,"featured_media":1400,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[862,2133,529,2,449,33,2132],"class_list":["post-1399","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-ads","tag-castlestealer","tag-deliver","tag-google","tag-loader","tag-malicious","tag-oxloader"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/1399","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1399"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/1399\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/1400"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1399"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1399"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1399"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}