Tag: oxloader

1 Attack Reports | 0 Vulnerabilities

Attack reports

OXLOADER: new loader evading detection to drop infostealer

A previously undocumented Windows loader designated as OXLOADER delivers the CASTLESTEALER infostealer through malicious Google Ads campaigns, achieving remarkably low detection rates. The loader employs multiple obfuscation layers including control-flow flattening, opaque predicates, and mixed Boo…
obfuscation
malvertising
infostealer
google ads
anti-vm
donutloader
russian-speaking actor
2026-06-19
castlestealer
oxloader
reloc section abuse
Published: June 19, 2026
Downloadable IOCs: 12
Click here to see more Attack Reports