Hackers Impersonate Node.js Installer in Google Ads to Deploy Infostealer Malware

Elastic Security Labs reports an active US-targeted malvertising campaign that impersonated the Node.js installer via sponsored Google Ads to deliver OXLOADER, a stealthy loader with multiple sandbox-evasion checks, which in turn loads the CASTLESTEALER infostealer entirely in memory; the report includes technical analysis, IoCs (domains, hashes, C2 IPs), and mitigation recommendations.