New OXLOADER Loader Uses Malicious Google Ads to Deliver CastleStealer

Elastic Security Labs described campaign REF8372, in which a previously unreported OXLOADER loader delivers CastleStealer through malicious Google Ads. The campaign uses a fake Node.js website and files hosted on Storj. Evidence indicates that the threat actor is likely Russian-speaking and financially motivated; systems located in the CIS region are excluded from infection.