New OXLOADER Loader Uses Malicious Google Ads to Deliver CastleStealer

A sophisticated new cyber threat has emerged that weaponizes the trusted Google advertising ecosystem to distribute malicious payloads. Security researchers at Elastic Security Labs have uncovered a previously undocumented malware loader, dubbed OXLOADER, which serves as a delivery mechanism for the dangerous CastleStealer information-stealing malware. This discovery highlights how threat actors continue to evolve their tactics, abusing legitimate platforms to bypass traditional security defenses and compromise unsuspecting victims.

The attack chain begins when users search for popular software or services and encounter malicious Google advertisements that redirect to compromised websites hosting the OXLOADER. This initial loader operates with stealth, carefully designed to evade detection by security solutions. Once executed on a victim's machine, OXLOADER deploys CastleStealer, a potent information theft tool capable of exfiltrating sensitive data including credentials, browser information, cryptocurrency wallets, and other valuable personal or corporate information. Researchers have identified several indicators suggesting the threat actors behind this campaign are likely Russian-speaking and primarily financially motivated. The infrastructure, code patterns, and targeting all align with established cybercriminal groups focused on monetizing