A malvertising campaign targets developers and Windows users by impersonating official Node.js and Deno installers through sponsored Google Ads. The attack chain deploys OXLOADER to facilitate the execution of CASTLESTEALER, CastleRAT, or Stealit malware. A primary technical innovation is the abuse of Node.js Single Executable Applications (SEA) and the Deno runtime to encapsulate malicious payloads. By executing within these legitimate JavaScript environments, the malware evades traditional EDR/AV solutions that trust common developer binaries. The impact includes the theft of sensitive credentials, API keys, and tokens, creating significant risks for developer workstations and potential supply chain contamination.

• Campaign Overview & Delivery

  • Uses Google Ads malvertising to redirect targets to fraudulent landing pages.
  • Employs "ClickFix" social engineering and fake installer packages to deceive users.
  • Primarily targets Windows-based developers and IT professionals in the United States.

• Technical Mechanics of OXLOADER

  • Acts as a stealthy initial loader designed to bypass enterprise security products.
  • Facilitates the transition from initial infection to final-stage malware execution.
  • Closely associated with the Castleloader framework for payload delivery.

• Evasion via Runtime Encapsulation

  • Leverages Node.js Single Executable Applications (SEA) to bundle malicious code into legitimate-looking binaries.
  • Utilizes the Deno JavaScript runtime to execute payloads under the guise of standard developer processes.
  • Effectively blinds EDR/AV solutions by masquerading as trusted, signed, or common developer-centric binaries.

• Payload Functionality & Impact

  • Deploys infostealer variants (CASTLESTEALER, Stealit) and Remote Access Trojans (CastleRAT).
  • Focuses on the exfiltration of high-value credentials, API keys, and authentication tokens.
  • Poses a critical risk of supply chain contamination via compromised developer environments.

• Detection & Mitigation Strategies

  • Monitor for anomalous child processes or unexpected network activity originating from Node.js or Deno runtimes.
  • Implement strict web filtering to block fraudulent software download domains and malvertising vectors.
  • Enhance endpoint telemetry to specifically audit the behavior of developer-centric command-line tools and runtimes.