Malware

CastleStealer

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

2 techniques

T1583Acquire InfrastructureEvidence1

Hackers are using fake Google Ads to push a brand-new malware loader that disguises itself as the popular Node.js installer.

T1583.001DomainsEvidence1

the campaign leverages malicious Google Ads as a starting point to distribute the malware

Initial Access

1 technique

T1566.002Spearphishing LinkEvidence2

The attack begins when unsuspecting users enter queries such as "lts version of node.js" on search engines like Google, redirecting them to a fake website ("node-js[.]prentiva99[.]info") surfaced via bogus ads

Execution

1 technique

T1059.003Windows Command ShellEvidence1

Users who end up interacting with the site are served a batch script hosted on Storj

Stealth

1 technique

T1620Reflective Code LoadingEvidence1

The final payload, CASTLESTEALER, is then delivered entirely in memory using an open-source shellcode generator called DonutLoader, leaving almost no trace on disk.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

Users who end up interacting with the site are served a batch script hosted on Storj... Running the batch script displays a bogus installation wizard user interface (UI), while stealthily downloading a next-stage payload, a Storj-hosted executable dubbed OXLOADER through a PowerShell command

INDICATORS OF COMPROMISE

IOCs tracked for this family

17 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

6 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

8 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

3 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

hash.sha256●●●●●●●●●●●●View more in apptoday

ip.v4●●●●●●●●●●●●View more in apptoday

hash.md5●●●●●●●●●●●●View more in app22 days ago

hash.sha256●●●●●●●●●●●●View more in app22 days ago

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

the hacker newsNews

Jun 22, 2026

New OXLOADER Loader Uses Malicious Google Ads to Deliver CastleStealer

.NET information stealer delivered via OXLOADER; used to steal information from infected systems.

cyber security newsNews

Jun 22, 2026

Hackers Impersonate Node.js Installer in Google Ads to Deploy Infostealer Malware

A .NET-based infostealer delivered by OXLOADER that harvests sensitive data from infected Windows systems. It is delivered entirely in memory in this campaign, reducing disk artifacts.

elastic security labsNews

Jun 1, 2026

OXLOADER: new loader evading detection to drop infostealer - Elastic Security Labs

Information stealer delivered by OXLOADER. The report notes in-memory delivery as a .NET payload and references shared AES key material used for C2 communications in prior CASTLESTEALER samples.

huntress blogNews

Apr 30, 2026

ClickFix Removes Your Background but Leaves the Malware | Huntress

An obfuscated .NET information stealer delivered by CastleLoader. It performs Russian-locale exclusion, host fingerprinting, screenshot capture, browser credential and cookie theft, crypto-wallet and IndexedDB collection, Discord token theft, Telegram session theft, Restart Manager-based locked-file handling, process hollowing into PowerShell, and encrypted raw TCP C2 communications.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching17

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.