Lost in relocation: analysis of a new loader distributing CASTLESTEALER

A new Windows loader, named OXLOADER, has been identified distributing the CASTLESTEALER information-stealing malware. This loader employs sophisticated obfuscation techniques and exploits the Windows .reloc section for shellcode staging. It is being spread through malicious Google Ads that impersonate Node.js, leading victims to fake landing pages. The campaign appears to be financially motivated, with targeting exclusions suggesting a Russian-speaking threat actor.