Netskope Threat Labs

OxLoader

ATP Sandbox Adv. HeuristicsAV

OxLoader is a newly documented loader that distributes the Castlestealer payload, with researchers describing its relocation-based anti-analysis techniques.

First seen
July 2026
Last seen
September 2026
Alert Name
Script-BAT.Trojan.OxLoader
Trojan.OxLoader.1
Trojan.OxLoader.2
Win64.Trojan.OxLoader