OXLOADER Uses Malicious Google Ads to Deliver CastleStealer
Summary
Elastic Security Labs described REF8372, a campaign using malicious Google Ads and a fake Node.js download site to deliver CastleStealer via OXLOADER. The loader uses obfuscation, anti-sandbox checks, Storj staging and DLL side-loading.
Key points
- Elastic Security Labs described REF8372, a campaign delivering CastleStealer through the previously unreported OXLOADER loader.
- Malicious Google Ads direct users searching for Node.js downloads to a fake site at node-js[.]prentiva99[.]info.
- A batch script hosted on Storj downloads OXLOADER using PowerShell and runs it with -Verb RunAs, triggering a Windows UAC prompt.
- The attack uses DLL side-loading to launch a rogue DLL that decrypts and executes CastleStealer.
- OXLOADER uses control-flow flattening, opaque predicates, mixed Boolean-Arithmetic, self-modifying decryption stubs, and the Windows .reloc section to stage shellcode.
- Anti-sandbox measures and exclusions for CIS-region systems suggest a financially motivated, likely Russian-speaking actor; the article says this attribution is not certain.
- Google removed the advertiser account and campaigns on May 14, 2026; researchers said it is unknown whether the account was linked to the threat actor.
Article Details
- Attack Vectors
- Malicious Google Ads directed users searching for Node.js downloads to the fake site node-js[.]prentiva99[.]info.
- The fake site served a batch script hosted on Storj. The script displayed a bogus installation wizard while using PowerShell to download and run the OXLOADER executable.
- OXLOADER used DLL side-loading to launch a rogue DLL, which decrypted and executed CastleStealer.
- OXLOADER used obfuscation and checks for sandboxed environments to hinder detection and analysis.
- Defensive Notes
- Google removed the advertiser account and its ad campaigns on 2026-05-14.
- Elastic researchers reported low detection rates for OXLOADER across static engines and detonation runs.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| HOSTNAME | node-js[.]prentiva99[.]info | Fake Node.js download site promoted through malicious ads to distribute a batch script leading to OXLOADER. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationOXLOADER used control-flow flattening, opaque predicates, mixed Boolean-Arithmetic, and self-modifying decryption stubs to obfuscate its code.T1036 · MasqueradingThe batch script displayed a bogus installation wizard, and OXLOADER binaries used benign-looking code to masquerade as legitimate files.T1059.001 · PowerShellThe batch script used a PowerShell command to download and execute the Storj-hosted OXLOADER executable.T1105 · Ingress Tool TransferThe batch script downloaded the next-stage OXLOADER executable from Storj.T1140 · Deobfuscate/Decode Files or InformationThe rogue DLL decrypted the CastleStealer payload before execution.T1204.002 · Malicious FileThe infection chain depended on users interacting with the fake download site and running its served batch script.T1497.001 · System ChecksOXLOADER checked for sandboxed environments and used anti-VM measures.T1574.002 · DLL Side-LoadingOXLOADER used DLL side-loading to launch a rogue DLL that decrypted and executed CastleStealer.
People
Threat Actors
Malware
CastleLoaderCastleStealer is a .NET information stealer that was recently distributed alongside CastleLoader through a ClickFix-style lure masquerading as a free image-editing tool as part of a campaign codenamed BackgroundFix.CastleStealerResearchers uncovered REF8372, a campaign that uses malicious Google Ads and a fake Node.js site to distribute CastleStealer through the previously unreported loader OXLOADER.OXLOADERResearchers uncovered REF8372, a campaign that uses malicious Google Ads and a fake Node.js site to distribute CastleStealer through the previously unreported loader OXLOADER.
Products
Google AdsResearchers uncovered REF8372, a campaign that uses malicious Google Ads and a fake Node.js site to distribute CastleStealer through the previously unreported loader OXLOADER.Node.jsResearchers uncovered REF8372, a campaign that uses malicious Google Ads and a fake Node.js site to distribute CastleStealer through the previously unreported loader OXLOADER.StorjThe operation appears financially motivated and likely Russian-speaking, while using obfuscation, anti-sandbox checks, and legitimate services like Storj to evade detection.