OXLOADER Malware Loader Delivering CASTLESTEALER .NET Infostealer via Node.js Malvertising
OXLOADER Malware Loader Delivering CASTLESTEALER .NET (TL-2026-0857), also tracked as OxLoader, is a high-severity malware campaign, first published 2026-06-18. It has no confirmed attribution, affects Microsoft Windows, maps to 23 MITRE ATT&CK techniques (T1005, T1027.013, T1036.005), and is covered by 9 detection rules and 24 indicators of compromise.
Key facts for TL-2026-0857
- Threat ID
- TL-2026-0857
- Also known as
- OxLoader, CastleStealer
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-18
- Last reviewed
- 2026-06-18
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, general
- Target regions
- North America
- Detection rules
- 9
- Indicators of compromise
- 24
Malware and tooling in OXLOADER Malware Loader Delivering CASTLESTEALER .NET
Malware and tooling: CASTLESTEALER, OXLOADER, DonutLoader
OXLOADER is a heavily obfuscated Windows loader that uses control-flow flattening, module stomping, and extensive anti-analysis to stage DonutLoader, which deploys the CASTLESTEALER .NET infostealer in memory. The campaign was distributed through malicious Google Ads impersonating Node.js and is attributed by Elastic Security Labs to a financially motivated, Russian-speaking actor; the malvertising infrastructure was dismantled on 2026-05-14.
How OXLOADER Malware Loader Delivering CASTLESTEALER .NET works
OXLOADER is a multi-stage Windows loader documented by Elastic Security Labs (published 2026-06-19) that culminates in the in-memory execution of CASTLESTEALER, a custom .NET information stealer. Initial access is achieved through malvertising: malicious Google Ads impersonating the Node.js project lure victims to the landing page node-js.prentiva99.info, which redirects through app.miloyannopoulos.com/download?subid1=download and ultimately serves a Windows batch script hosted on the abused Storj service link.storjshare.io. The batch script launches PowerShell with UAC elevation (-Verb RunAs) to execute OXLOADER, which masquerades as legitimate tooling using filenames such as apimonitor-x64.exe and node-v24.15.0-x64-86.exe.
OXLOADER is protected by a dense obfuscation stack: control-flow flattening, Mixed Boolean-Arithmetic (MBA) expressions, opaque predicates, function chunking across non-contiguous regions, indirect runtime-computed jumps, and self-modifying decryption stubs executed in three iterations across different memory regions. It resolves imports dynamically using Adler-32 API hashing. Before proceeding, OXLOADER runs an environment-evaluation battery designed to defeat sandboxes and avoid CIS-region systems: a WNetAddConnection2W emulation check using the malformed resource '*72s@1s' that expects ERROR_BAD_NAME (0x43); a minimum CPU count of 3; a minimum of 3 GB physical RAM via GlobalMemoryStatusEx; a display refresh rate of at least 20 Hz queried through WMI Win32_VideoController; a GetUserGeoID check that excludes CIS countries; and a GetUserDefaultUILanguage check that excludes Russian (0x419).
For execution OXLOADER performs module stomping: it copies C:\Windows\System32\dui70.dll to a temporary path with a random name and an .ocx extension, adds a new RWX section named .xtext, abuses the .reloc section to house malicious code in place of legitimate relocation entries, and loads the modified DLL via LoadLibraryA. It then stages shellcode generated with DonutLoader, which wraps the CASTLESTEALER .NET assembly into position-independent code, decompresses it with aPLib, and bootstraps via a RunPE() routine for reflective in-memory loading.
CASTLESTEALER is a .NET stealer that communicates with C2 servers at 89.124.95.161 and 89.124.115.82. Its strings and configuration are protected with the Chaskey-LTS block cipher in CTR mode (key 6E0A1F8F77F7011561F6F9CA96B71B8F, IV 956C6128E9362E075F8D006C93616A66) and an additional string XOR routine of the form a1 ^ (a2 + 0x33FDA). Elastic attributes the operation to a financially motivated, Russian-speaking threat actor based on CIS-region and Russian-language exclusions; the Google Ads registrant was recorded as 'ВОЛОДИМИР ТЕРЕЩЕНКО'. The ad campaign was last shown on 2026-04-23 and the supporting infrastructure was dismantled on 2026-05-14.
MITRE ATT&CK techniques used in TL-2026-0857
Collection
Defense Evasion
T1027.013 Encrypted/Encoded File; T1036.005 Match Legitimate Resource Name or Location; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1497.001 System Checks; T1620 Reflective Code Loading
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059.001 PowerShell; T1059.003 Windows Command Shell; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1105 Ingress Tool Transfer; T1573.001 Symmetric Cryptography
Discovery
T1082 System Information Discovery; T1614 System Location Discovery; T1614.001 System Language Discovery
Initial Access
Privilege Escalation
T1548.002 Bypass User Account Control
Credential Access
T1555.003 Credentials from Web Browsers
stealth
Resource Development
Affected products and versions in OXLOADER Malware Loader Delivering CASTLESTEALER .NET
- Microsoft — Windows
Vulnerable versions: Windows 10; Windows 11
Remediation for OXLOADER Malware Loader Delivering CASTLESTEALER .NET
Immediate actions
- Block C2 IPs 89.124.95.161 and 89.124.115.82 at the perimeter
- Block/blackhole the malvertising domains node-js.prentiva99.info and app.miloyannopoulos.com
- Hunt for and quarantine the listed OXLOADER/CASTLESTEALER and batch-script SHA-256 hashes across the fleet
- Alert on PowerShell launched with -Verb RunAs from batch scripts originating in user download/temp directories
Workarounds
- Enforce strict UAC prompts and remove local administrator rights for standard users to break the -Verb RunAs elevation step
- Use application allow-listing to prevent execution of unsigned binaries masquerading as installers (e.g., apimonitor-x64.exe, node-v24.15.0-x64-86.exe)
Longer-term hardening
- Deploy EDR with behavioral detections for module stomping, RWX section creation, and CLR/reflective loading from suspicious memory
- Restrict and monitor LOLBins and PowerShell execution policy; enable PowerShell script-block and module logging
- Implement DNS filtering and block newly registered / low-reputation domains used in malvertising
- User awareness training on software acquired via search-engine ads; promote acquisition of Node.js only from nodejs.org
Timeline of OXLOADER Malware Loader Delivering CASTLESTEALER .NET
- Final impression of the malicious Google Ads campaign impersonating the Node.js project; per Elastic Security Labs the ad was last shown on this date and the landing site (node-js.prentiva99.info) is now offline.
- Elastic Security Labs discovered that the redirector endpoint app.miloyannopoulos.com/download responded with one of two Location header values, randomly serving either a Windows batch-script variant or an executable variant of the OXLOADER delivery chain.
- With the advertiser banned, the supporting malvertising infrastructure (Node.js-impersonating landing page and redirector chain) went offline, ending observed live distribution.
- Google removed the advertiser and all associated ad campaigns entirely, terminating the malvertising distribution channel for OXLOADER/CASTLESTEALER.
- Threat ingested and tracked by Threadlinqs Intelligence as TL-2026-0857 for detection engineering and correlation.
- Network and file IOCs published: C2 IPs 89.124.95.161 and 89.124.115.82, malvertising/redirector domains, Storj payload-hosting URLs, and OXLOADER/CASTLESTEALER SHA-256 hashes.
- Elastic released YARA detection signatures Windows.Trojan.OxLoader and Windows.Trojan.CastleStealer alongside the report.
- Elastic Security Labs published its technical analysis of the OXLOADER loader and CASTLESTEALER .NET infostealer, documenting the full malvertising-to-in-memory-execution attack chain.
Sources cited for OXLOADER Malware Loader Delivering CASTLESTEALER .NET
- OXLOADER: A new malware loader delivering CASTLESTEALER
- Elastic Security Labs — Malware analysis
- MITRE ATT&CK — Malicious Advertising (T1583.008)
- MITRE ATT&CK — Reflective Code Loading (T1620)
- MITRE ATT&CK — Hijack Execution Flow: DLL Side-Loading (T1574.002)
- Threat actors misuse Node.js to deliver malware and other malicious payloads
Threats related to OXLOADER Malware Loader Delivering CASTLESTEALER .NET
- Infostealer Malware Hijacks Claude Login Sessions to Bypass MFA and Drain Usage; Related FakeAgent Malvertising Campaign Deploys SectopRAT via Trojanized Claude Desktop Installer
- SourTrade Malvertising Campaign Assembles Windows Malware In-Browser via ServiceWorker/SharedWorker JavaScript Chain to Defeat Hash-Based Detection
- Operation Endgame: Global Law Enforcement Takedown Disrupts SocGholish, Amadey, and StealC Malware-as-a-Service Networks
- NWHStealer Adopts Bun JavaScript Runtime for Distribution — Rust Infostealer via Bun-Bundled JS Loaders
- ClickFix Campaigns Deploy PavinLoader With Blockchain-Based C2 and Amatera Stealer
- ScreenConnect Masked as Freeware: Large-Scale AsyncRAT Distribution Campaign via SEO-Poisoned Fake Software Sites
Detection coverage for TL-2026-0857
As of 2026-06-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0857 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.