Fake Node.js Google Ads Drop CastleStealer via OXLOADER

If you searched for something as boring as "lts version of node.js" earlier this year and clicked the top result, there is a non-zero chance you ended up somewhere considerably less boring. Elastic Security Labs has published details of a campaign, tracked as REF8372, that bought Google Ads to funnel developers toward a fake Node.js download page and quietly drop an information stealer called CastleStealer.

The ad ran under a verified advertiser name supposedly based in Ukraine. Hijacked, fronted, bought outright, take your pick. Google killed it on 14 May 2026, but the traffic had already been flowing for some time before that.

Storj is doing a lot of unpaid work for attackers

The lookalike site served a batch script hosted on Storj, the decentralised cloud storage service. This is becoming a pattern. Legitimate platforms with solid reputations get used as delivery infrastructure because the security tools doing reputation checks tend to nod them through. Storj joins a long list that includes GitHub, Discord CDN, Cloudflare R2 and various pastebin clones.

From the script, the chain moves through a convincing installer UI, a PowerShell command that triggers a UAC prompt, and finally a brand new loader the researchers have named OXLOADER.

OXLOADER is the part worth paying attention to

The loader is built to be a nightmare for static analysis and a headache for sandboxes. Among its tricks:

• Control-flow flattening, which scrambles the order of code so it is hard to follow what runs when.
• Opaque predicates, fake conditional branches designed to confuse decompilers.
• Self-modifying decryption stubs, so the payload only assembles itself at runtime.
• Abuse of the Windows .reloc section to stage shellcode in a place defenders rarely look.

The combined effect is exactly what you would expect: low detection rates across mainstream antivirus engines, at least for now.

The researchers also noted the loader skips machines in the Commonwealth of Independent States, which is the usual calling card of a Russian-speaking, financially motivated operator. CastleStealer itself is a .NET stealer that has previously turned up alongside CastleLoader in a ClickFix-style campaign pretending to be a free image editor.

The boring defence still works

The lesson here is not new. The sponsored result at the top of a search page is not vetted in any meaningful security sense. Verified advertiser badges mean someone produced ID at some point, not that the destination is safe today. Developers in a hurry, copy-pasting tooling between machines without thinking too hard about the source, are a soft target.

Typing the real project URL by hand, or scrolling past the ad block to the organic result, remains one of the cheapest defences available. It is also one of the least practised, which is the whole reason campaigns like REF8372 keep being worth the ad spend.