OXLOADER is a previously undocumented Windows loader that delivers the CASTLESTEALER infostealer through malicious Google Ads campaigns. It achieves low detection rates by employing multiple obfuscation layers such as control-flow flattening, opaque predicates, mixed Boolean-Arithmetic techniques, self-modifying decryption stubs, and abuse of the Windows .reloc section for shellcode staging. The loader is distributed via malvertising campaigns impersonating Node.js installations, redirecting victims through intermediary domains to batch scripts hosted on the Storj decentralized storage network. It implements five anti-virtual machine and language checks, including exclusions for CIS-region and Russian-language systems, suggesting a financially motivated Russian-speaking threat actor. OXLOADER uses DonutLoader to deliver the .NET-based CASTLESTEALER payload directly in memory, evading traditional detection mechanisms through deliberate engineering choices. There are no known patches or vendor mitigations since this is malware rather than a software vulnerability. Indicators include multiple file hashes, URLs, and domains associated with the campaign. The threat is currently reported targeting the United States.

The impact of OXLOADER is the delivery and execution of the CASTLESTEALER infostealer on infected Windows systems. This results in the potential theft of sensitive information from victims. The loader's advanced evasion techniques reduce the likelihood of detection by traditional security solutions, increasing the risk of successful compromise. The use of malvertising campaigns for distribution broadens the potential victim pool. The anti-VM and language checks limit exposure to certain regions, focusing the threat on specific targets. There are no known exploits in the wild beyond this campaign, and no official patches or fixes exist since this is malware.

As this is malware distributed via malvertising campaigns, there are no patches or official fixes available. Organizations should focus on blocking known indicators of compromise such as the provided hashes, URLs, and domains associated with OXLOADER. Security teams should update detection signatures to identify the obfuscation techniques and payload behaviors described. User awareness training to avoid downloading software from untrusted sources, especially via suspicious ads, is recommended. Network defenses should consider blocking access to the identified malicious domains and URLs. Since the malware uses anti-VM and language checks, monitoring for unusual execution environments may help detect attempts. No vendor advisory indicates that no action is required or that the threat is already mitigated.