A newly identified malware loader, dubbed OXLOADER, is being distributed through malicious Google advertisements, aiming to deliver the CASTLESTEALER information-stealing malware. Security researchers have observed OXLOADER employing a range of sophisticated obfuscation techniques to evade detection by static analysis tools and sandbox environments.
The distribution campaign leverages Google Ads that impersonate legitimate software, specifically targeting users searching for the Node.js development environment. Victims who click on these deceptive ads are redirected through an intermediary website to a batch script hosted on Storj, a legitimate cloud storage service. This strategy allows the threat actor to bypass domain reputation filters.
The batch script, upon execution, presents a fake software installation interface to the user. It then proceeds to download the next stage of the malicious payload, an executable file, from the Storj URL using PowerShell. The script also attempts to elevate its privileges by triggering a User Account Control (UAC) prompt.
Technical analysis of OXLOADER reveals a multi-layered approach to evading detection. The malware begins execution during the C++ runtime initialization phase, before any user-defined code runs. It utilizes self-modifying code and multiple decryption stubs to gradually unpack itself. This process involves decrypting various code segments using a single-byte XOR key that is updated after each byte is processed.
To further hinder static analysis, OXLOADER employs techniques such as control-flow flattening, mixed Boolean-Arithmetic operations, opaque predicates, and the fragmentation of code across non-contiguous memory regions. These methods disrupt the ability of tools like IDA Pro to accurately reconstruct function boundaries, necessitating manual intervention for analysis. The malware also dynamically resolves its imported functions by combining a string decryption algorithm with an Adler-32 API hashing algorithm.
OXLOADER incorporates several checks designed to detect and avoid execution within analysis environments. These include attempting to connect to a malformed network resource and verifying the specific error code returned, checking for a minimum of three CPU cores, ensuring at least 3 GB of physical memory is available, and querying the display's refresh rate, expecting a value above 20 Hz.
Additionally, the malware performs geographic and language-based exclusions. It checks the system's geographic region using GetUserGeoID, halting execution if it detects a CIS country. It also examines the default user interface language, aborting if the language is set to Russian. These checks suggest that the threat actor is likely Russian-speaking and financially motivated, potentially targeting users outside of Russia and CIS countries.
Following the successful completion of these checks, OXLOADER proceeds to stage its shellcode. It copies a legitimate Windows DLL, dui70.dll, to a temporary location, renaming it with a .ocx extension. A new section with read, write, and execute permissions is created within this renamed DLL. This section is then used to store and execute the subsequent stage of the malicious code. The modified DLL is loaded into the loader's process using LoadLibraryA. The .reloc section, typically used for relocating code when a program is loaded at a non-preferred address, is abused by the malware to stage its shellcode.
The campaign was identified by Elastic Security Labs, which has implemented advanced prevention capabilities to block the entire attack chain. The threat actor's Google Ads account, registered under the name ВОЛОДИМИР ТЕРЕЩЕНКО and based in Ukraine, was eventually removed from Google in May 2026. The exact identity of the operator remains unconfirmed.
