{"id":278547,"date":"2026-06-22T09:20:00","date_gmt":"2026-06-22T13:20:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/06\/22\/new-oxloader-loader-uses-malicious-google-ads-to-deliver-castlestealer\/"},"modified":"2026-06-22T10:40:09","modified_gmt":"2026-06-22T14:40:09","slug":"new-oxloader-loader-uses-malicious-google-ads-to-deliver-castlestealer","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/06\/22\/new-oxloader-loader-uses-malicious-google-ads-to-deliver-castlestealer\/","title":{"rendered":"New OXLOADER Loader Uses Malicious Google Ads to Deliver CastleStealer"},"content":{"rendered":"

New OXLOADER Loader Uses Malicious Google Ads to Deliver CastleStealer<\/a><\/p>\n

https:\/\/thehackernews.com\/2026\/06\/new-oxloader-loader-uses-malicious.html<\/a><\/p>\n

Publish Date: 2026-06-22 09:20:00<\/a><\/p>\n

Source Domain: thehackernews.com<\/a><\/p>\n

\ue804Ravie Lakshmanan<\/span>\ue802Jun 22, 2026<\/span><\/span>Malvertising \/ Endpoint Security<\/span><\/p>\n

Cybersecurity researchers have disclosed details of a new campaign that delivers CastleStealer by means of a previously unreported malware loader dubbed OXLOADER.<\/p>\n

According to Elastic Security Labs, the campaign leverages malicious Google Ads as a starting point to distribute the malware. Evidence indicates that the threat actor is likely Russian-speaking and financially motivated, owing to the presence of explicit exclusions to prevent infecting machines located in the Commonwealth of Independent States (CIS) region. The campaign has been codenamed REF8372.<\/p>\n

“The loader uses several obfuscation layers (control-flow flattening, opaque predicates, mixed Boolean-Arithmetic), self-modifying decryption stubs, and abuses the Windows .reloc section to stage shellcode,” researchers Daniel Stepanic and Jia Yu Chan said in a technical breakdown.<\/p>\n

The attack begins when unsuspecting users enter queries such as “lts version of node.js” on search engines like Google, redirecting them to a fake website (“node-js[.]prentiva99[.]info”) surfaced via bogus ads published under the verified name “\u0412\u041e\u041b\u041e\u0414\u0418\u041c\u0418\u0420 \u0422\u0415\u0420\u0415\u0429\u0415\u041d\u041a\u041e” that’s purportedly based in Ukraine.<\/p>\n

It’s currently unknown if the advertiser account is linked to the actual threat actor, or if it’s a front account or a purchased identity. The advertiser account, along with its ad campaigns, was removed from Google on May 14, 2026.<\/p>\n

Users who end up interacting with the site are served a batch script hosted on Storj, a decentralized, open-source cloud storage platform. The abuse of Storj once again illustrates how threat actors continue to leverage legitimate services to evade domain-based reputation filters.<\/p>\n

\"\"<\/p>\n

Running the batch script displays a bogus installation wizard user interface (UI), while stealthily downloading a next-stage payload, a Storj-hosted executable dubbed OXLOADER through a PowerShell command and executing it with -Verb RunAs…<\/p>\n

Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

New OXLOADER Loader Uses Malicious Google Ads to Deliver CastleStealer https:\/\/thehackernews.com\/2026\/06\/new-oxloader-loader-uses-malicious.html Publish Date: 2026-06-22 09:20:00…<\/p>\n","protected":false},"author":1,"featured_media":278548,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEi8sz7SHbQd4E8HNEKbvGGSYhPpJrUydP_gCRt_mWYYTr6QHLmChyphenhyphenca6BXhLBXA4OyKw-eS9xbqRqpKcYWFqDp4HoLBYKjVdWzhF0K1pqjX2bPtB91y1P1PZ8gh5r7Bpp-PIeUJVi_Hki91Qf6YjFAtFmf-qh7V9gNzmbEh_A2lISCvCDnNMALAuiqAlkL_\/s1600\/loader.jpg","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[24,32,34],"class_list":["post-278547","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-cybersecurity","tag-malware","tag-threat-actor"],"_links":{"self":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/278547"}],"collection":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=278547"}],"version-history":[{"count":1,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/278547\/revisions"}],"predecessor-version":[{"id":278549,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/278547\/revisions\/278549"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/278548"}],"wp:attachment":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=278547"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=278547"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=278547"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}