Fake Google Ads Are Hiding Password Thieves

Researchers at Elastic Security Labs have uncovered a new malware campaign, codenamed REF8372, that uses purchased Google Ads to direct victims to a fake website impersonating the Node.js download page. Node.js is a widely used software runtime that developers install to build and run web applications.

Here is how it works. Someone searches for something ordinary — like the latest version of Node.js — and a sponsored result appears at the top. It looks legitimate. They click it, land on a convincing fake site, and download what appears to be a setup file. That file silently installs a loader called OXLOADER, which in turn drops CastleStealer, a password-stealing program that targets saved browser credentials, cookies, and other sensitive data.

The campaign is believed to be run by a financially motivated, Russian-speaking group. The attackers deliberately excluded machines in CIS (Commonwealth of Independent States — former Soviet states) to avoid infecting their own region, a common pattern in financially motivated operations based there.

OXLOADER is built to be hard to catch. It uses heavy code obfuscation (techniques that make code deliberately confusing to analyse), anti-sandbox measures, and self-modifying decryption to slip past automated security tools. Early detection rates are low.

The advertiser account was removed by Google on 14 May 2026, but the campaign machinery — fake sites, payloads, the full infrastructure — is still being studied.

What you should do: If you recently downloaded Node.js or any developer tool via a search engine result, verify the download came from the official site at nodejs.org. If you are unsure, run a scan with your antivirus software immediately.

State-sponsored group Sapphire Sleet — also known as BlueNoroff — hijacked the Mastra NPM package ecosystem on 17 June. Mastra is an open-source TypeScript framework developers use to build AI agents and automated workflows.

In a 45-minute window, the attackers compromised a legitimate package maintainer account and pushed 141 modified packages, each containing a malicious dependency that masqueraded as a popular date library. The affected packages have roughly 8 million weekly downloads.

Any developer who ran npm install during that window — even on a build server, not a personal machine — may have executed the malicious payload. The malware collected system information and targeted over 160 cryptocurrency browser extensions.

This is a supply chain attack (where the compromise happens upstream, inside a trusted tool, before it reaches you). Cybersecurity firms Aikido, Ox, Socket, Sonatype, and StepSecurity have published indicators of compromise. If you use Mastra, check their advisories and rotate all credentials immediately.

What Squid Proxy is: Squid is a widely used open-source web proxy that organisations run to cache web traffic, reduce bandwidth, and speed up browsing for everyone sharing that network connection.

What it is: A memory leak flaw, nicknamed "Squidbleed" for its resemblance to the infamous Heartbleed bug, in Squid's FTP parser. The parser reads past the edge of its allocated memory buffer (the chunk of memory set aside to hold one piece of data) and can pull in leftover data from a previous, unrelated user's HTTP request.

Who's at risk: Organisations running an unpatched Squid instance as a shared proxy — corporate networks, schools, and public Wi-Fi hotspots are the highest-risk environments, since multiple people's traffic passes through the same Squid instance. The flaw has existed in the software since 1997.

CVSS: Not yet formally scored — treat as High given the Heartbleed-style data exposure risk it carries.

Root cause: Squid's FTP parser does not properly bound-check where it reads from in memory. When triggered, it can read beyond the data it's supposed to access and into memory still holding fragments of someone else's request — including, potentially, authentication credentials, session tokens, and API keys, if that traffic was unencrypted HTTP.

Attack vector: An attacker who controls an FTP server reachable through the proxy can trigger the bug, causing the proxy to leak fragments of another user's recent HTTP traffic. The exposure is limited to cleartext HTTP — standard HTTPS connections relayed as opaque tunnels are not affected — but cleartext HTTP credentials still travel through plenty of enterprise and legacy systems.

Detection strategies:

1. Check your Squid version against the patched releases — version 7.6 and the Squid 8 branch both include the fix.
2. Audit whether your Squid deployment has FTP support enabled at all; if it's unused, that's your simplest mitigation.
3. Review proxy logs for FTP traffic patterns from unfamiliar or unexpected upstream servers.

Recommended actions:

1. Upgrade to Squid 7.6 or the Squid 8 branch immediately.
2. If you cannot patch right away, disable FTP support in your Squid configuration as an interim mitigation.
3. If your proxy serves a shared network (office, school, public Wi-Fi), treat any cleartext HTTP credentials that passed through it during the exposure window as potentially compromised.

The OXLOADER campaign works because a fake download site looked real enough to click. The entire attack collapses if you arrive at the genuine download page.

Before downloading any software, find the official website independently — not through a sponsored search result. Search results at the top of the page marked "Sponsored" or "Ad" are paid placements. Anyone can buy them, including attackers.

For developer tools or any software you plan to install, go directly to the project's official domain. For Node.js, that is nodejs.org. Bookmark it. Never download from a URL you arrived at via an ad.

This one habit would have stopped every person targeted by REF8372.

From 30 September 2026, certified Android devices in Brazil, Indonesia, Singapore, and Thailand will block app installs from developers who have not registered their identity with Google. This applies to Google Play and third-party stores alike. Google says it is targeting app scam operations that exploit sideloading (installing apps outside official stores). Critics, including the open-source repository F-Droid, argue the ID requirement effectively shuts out pseudonymous developers. For everyday users in those four countries: apps from verified developers install as normal. Anything unverified will be blocked or require a deliberate, high-friction override.