Lost in relocation: analysis of a new loader distributing CASTLESTEALER

Elastic Security LabsJune 19, 2026Threat Intel

Find out how a new obfuscated loader evades static detection using .reloc section abuse, five anti-VM/language checks and MBA obfuscation to deliver infostealer malware via Google Ads.

Summary from Elastic Security Labs.

Read the full article at Elastic Security Labs

Explained

The technology and terms in this story. Learn more

AttackInfostealerMalware that grabs saved passwords, browser cookies and crypto wallets from an infected computer.

Lost in relocation: analysis of a new loader distributing CASTLESTEALER

Explained

More in Threat Intel

Synthetic identities leave US lenders with $2.4 billion in fraud exposure

Sponsored: Should your threat hunt become a detection?

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 120

BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot

Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet