New OXLOADER Loader Uses Malicious Google Ads to Deliver CastleStealer

Researchers have identified a new campaign that uses a previously unknown malware loader called OXLOADER to deliver CastleStealer. The campaign starts with malicious Google Ads, which are used to distribute the malware. The threat actor behind the campaign is believed to be Russian-speaking and motivated by financial gain. Elastic Security Labs has disclosed details of the campaign, shedding light on this new distribution method. The use of malicious ads as a starting point allows the attacker to reach potential victims. The campaign's tactics suggest a focus on generating revenue.