A new and particularly disturbing cyberattack campaign is highlighting the dangers lurking even behind seemingly trustworthy online services . Cybersecurity researchers have revealed that hackers are exploiting Google’s advertising network (Google Ads) to distribute a previously unknown malware loader disguised as the popular Node.js installer .
The campaign primarily targets Windows in the United States and proves once again that cybercriminals are no longer relying solely on suspicious emails or malicious links. Instead, they are exploiting services that millions of people use every day and consider safe.
How the new attack works
The infection chain begins with a simple Google search. A user searching for Node.js installer sees a sponsored resultthat looks perfectly legitimate. With a single click, they are taken to a website designed to closely replicate the official Node.js environment.
See also: vm2 Node.js: 12 critical vulnerabilities allow sandbox escape
The visitor is then silently redirected through an intermediate domain and ends up downloading an installation file hosted on a legitimate cloud storage service. Using trusted infrastructure makes it significantly more difficult for security tools to detect the activity as malicious.
The file that is downloaded to the system displays a fake installation wizard, creating the impression that it is a completely normal software installation process. However, in the background, mechanisms are activated that download and execute the real malicious payload.
OXLOADER: A new and extremely dangerous malware loader
Researchers at Elastic Security Labs have identified the new malware, which they are tracking under the name OXLOADER. It is an advanced malware loader that until recently had not been publicly recorded and managed to operate with extremely low detection rates from antivirus and automated analysis systems.
OXLOADER is not limited to simple obfuscation techniques. On the contrary, it was designed from the beginning with the main goal of avoiding detection. Before proceeding to execute the malicious code, it performs multiple checks on the victim's system to determine whether it is running in a virtual environment or in a sandbox used by security researchers.
It checks features such as the number of processor cores, available RAM, screen refresh rate , and even the operating system's language settings
The final payload is CASTLESTEALER
After the checks are complete, OXLOADER activates the final malicious payload, an infostealer named CASTLESTEALER. This malware is built in .NET and is designed to steal sensitive data from the infected system.
See also: Node.js fixes critical vulnerabilities
Its potential targets include stored passwords, browsing cookies, authentication data, account information, and other personal information that can then be exploited in further attacks or offered for sale on the dark web.
Particularly worrying is the fact that much of the execution takes place directly in the computer's memory, leaving little trace on the hard drive. This technique makes it even more difficult to detect and analyze the threat.
Why ad-based attacks are becoming increasingly popular
Malvertising campaigns , the distribution of malicious software through online advertisements, have seen a dramatic increase in recent years. Attackers know that most users trust the first results of a search and rarely carefully check the address of the website they visit.
🔑 Secure your passwords with Proton Pass
Password manager from Proton — end-to-end encryption, passkeys, built-in 2FA, and monitoring for leaks of your credentials.
- ✔ Encrypted storage of passwords & passkeys
- ✔ Notification if any of your passwords are leaked (Dark Web Monitoring)
- ✔ Free version — on all devices
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
The case of the fake Node.js installer shows that even developers or technically savvy users can fall victim to a carefully designed attack. The fact that the hackers leveraged legitimate cloud services and crafted websites that closely mimic the authentic environment significantly increases the effectiveness of the scam.
See also: vm2 Node.js: “sandbox escape” vulnerability allows code execution
How can users be protected?
Experts recommend extreme caution when downloading software from the Internet. Users should avoid sponsored results when searching for development tools and download only from the vendors' official websites.
At the same time, active endpoint protection, updated security solutions and the adoption of digital vigilance practices remain critical factors against threats that are becoming increasingly sophisticated and exploit the very trust users place in the internet ecosystem.
