Malware
OXLOADER
- First Reported
- Jun 21, 2026
- Latest Reported
- Jun 22, 2026
Reported Context (2)
- Researchers uncovered REF8372, a campaign that uses malicious Google Ads and a fake Node.js site to distribute CastleStealer through the previously unreported loader OXLOADER. OXLOADER Uses Malicious Google Ads to Deliver CastleStealer
- Elastic Security Labs identified OXLOADER, a previously undocumented Windows loader, delivering CASTLESTEALER through malicious Google Ads and Storj-hosted staging files. Elastic Details OXLOADER Loader Delivering CASTLESTEALER Through Malicious Ads
Malware (2)
People (2)
Threat Actors (1)
MITRE ATT&CK (13)
Vendors (1)
Products (5)
Tools (4)
Countries (1)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.