OXLOADER: new loader evading detection to drop infostealer

Reported 19 Jun 2026 by otx · Severity: medium

A previously undocumented Windows loader designated as OXLOADER delivers the CASTLESTEALER infostealer through malicious Google Ads campaigns, achieving remarkably low detection rates. The loader employs multiple obfuscation layers including control-flow flattening, opaque predic