A newly discovered Windows malware loader dubbed OXLOADER is currently distributing the CASTLESTEALER infostealer through a sophisticated malicious Google Ads campaign.
Elastic Security Labs identified this active threat targeting U.S. victims who were actively searching for legitimate Node.js software versions.
Based on the deliberate exclusion of Commonwealth of Independent States (CIS) regions and Russian language configurations, researchers attribute this campaign to a financially motivated, Russian-speaking threat actor.
The threat actors behind OXLOADER have successfully maintained exceptionally low detection rates across traditional static antivirus engines and automated sandboxes.
They achieved this level of stealth by heavily layering complex obfuscation techniques, hijacking legitimate initialization processes, and abusing trusted cloud services.
The malicious Google Ads directing users to the payload were traced back to a verified advertiser registered in Ukraine. However, Google fully removed the ads and the associated account in mid-May 2026.
Fake Node.js Ads Spread Malware
The attack sequence begins when a victim clicks on the sponsored search result, landing on a sophisticated webpage that perfectly mimics a legitimate Node.js deployment platform.
Once a user interacts with the fake download button, they are redirected through an intermediary tracking domain.
This redirect ultimately serves a malicious Windows batch script hosted on Storj, a legitimate decentralized cloud storage service used here to bypass domain reputation filters.
Upon execution, the batch script displays a deceptive software installation wizard interface to lull the victim into a false sense of security.
While the fake progress bar loads, the script silently invokes PowerShell to download the next-stage executable from a separate Storj URL.
The script immediately launches this newly downloaded payload with elevated privileges, triggering a standard User Account Control prompt to gain administrative access over the operating system.
The earliest identified OXLOADER samples attempted to masquerade as API Monitor, a popular developer tool, before later variants adopted the more contextually accurate Node.js installer disguise.
According to Elastic research, OXLOADER begins executing its malicious code during the C Runtime initializer phase, completely hijacking the process before any actual user code runs.
The loader unrolls itself using self-modifying techniques and a rolling-XOR decryption routine where the plaintext byte is added to the key after each iteration.
To thoroughly break automated binary analysis tools, the developer implemented control-flow flattening, mixed Boolean-Arithmetic, opaque predicates, and function chunking.
If the environment passes all evasion checks, OXLOADER copies a legitimate Windows DirectUI Engine DLL to a temporary folder and renames it with an OCX extension.
The malware creates a new read-write-execute section within this file and stages its decrypted shellcode directly inside the .reloc section, a highly unusual technique that legitimate toolchains never use.
Finally, the malware deploys DonutLoader to execute the CASTLESTEALER payload in memory, initiating AES-encrypted command-and-control communications to steal user credentials.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
