Find out how a new obfuscated loader evades static detection using .reloc section abuse, five anti-VM/language checks and MBA obfuscation to deliver infostealer malware via Google Ads.

Sign in to keep reading the full article.

Covered in 2 articles

This Week In 4n6·

Week 25 – 2026

news.risky.biz·

Lost in relocation: analysis of a new loader distributing CASTLESTEALER (opens in new tab)

Covered in 2 articles

Week 25 – 2026

Risky Bulletin: Canada’s spy agency allowed to remove a botnet from Canadian devices