Loading story…
Researchers reported that GoFlateLoader, a Go-based malware loader, has infected more than 33,000 unique users since at least April 2026 by delivering multiple information stealers, including Lumma, Vidar, StealC, Amatera, Remus, and SvitStealer. The malware executes payloads entirely in memory by manually decoding and mapping a PE file without writing it to disk, reducing the chance of disk-based detection. Countries reported as most affected include Brazil, India, Argentina, Mexico, Turkey, and Spain.
The loader’s standout evasion method is extreme file-size inflation: samples commonly reach 700 MB to 950 MB because of a massive appended PE overlay, a tactic believed to help bypass upload and scanning limits in antivirus, EDR, sandbox, and threat-intelligence pipelines such as VirusTotal. Researchers said GoFlateLoader has been spread through fake cracked software and a malicious traffic distribution system that serves password-protected archives from landing pages, while also noting that use of Go’s syscall.Syscall with hardcoded dummy arguments may provide a useful detection marker.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
On 2026-06-11, follow-on reporting highlighted researchers' observation that GoFlateLoader uses Go's syscall.Syscall with hardcoded dummy arguments, which may serve as a detection marker. The report reiterated the loader's use of oversized PE overlays and delivery of multiple infostealers.
On 2026-06-10, Gen Digital published research describing GoFlateLoader's use of a massive 700–950 MB PE overlay to evade scanning limits and its in-memory execution of PE payloads. The report identified heavily affected countries including Brazil, India, Argentina, Mexico, Turkey, and Spain.
Gen Digital said that since the beginning of April 2026 it had protected more than 33,000 unique users from GoFlateLoader worldwide. The loader was observed delivering multiple infostealers including Amatera, Remus, Lumma, Vidar, StealC, and SvitStealer.
Gen Digital reported that GoFlateLoader has been active since at least April 2026. The Go-based loader has been distributed via cracked software and a malicious traffic distribution system serving password-protected archives.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 11 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecybersecuritynews.com
Open sourcegendigital.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed how **GuLoader**—also tracked as **CloudEyE**—has operated as a long-running malware downloader that abuses legitimate cloud platforms such as **Google Drive** and **Microsoft OneDrive** to host encrypted second-stage payloads. First seen delivering **Parallax RAT**, the VB6-based loader was rapidly adopted by multiple threat actors and used to distribute a wide range of malware, including **Agent Tesla, FormBook, NanoCore, NetWire, Remcos, Vidar, RedLine, Raccoon**, and **Warzone RAT**. Reports tied the service to large-scale spam and archive-based delivery chains using invoice and COVID-19 lures, while one investigation linked the broader CloudEyE operation to a commercial malware protection and delivery service marketed to cybercriminals. Technical analyses showed GuLoader evolving to make detection and reverse engineering harder, with encrypted shellcode, code randomization, process injection, anti-debugging, anti-VM timing checks, hypervisor detection, and vectored exception handling that disrupts linear debugging. Researchers described samples that decrypted embedded loader components with XOR keys, allocated memory through hidden or indirect API calls, and executed payloads through callback-based shellcode techniques after staging files and PowerShell. Multiple teams also published methods to statically unpack the loader, recover drop URLs, and decode final payloads, underscoring the continuing enterprise risk from credential theft, remote access, and follow-on compromise delivered through this inexpensive malware-as-a-service platform.
Aug 15, 2026
Researchers reported that **HijackLoader** is being distributed through pirated software download lures, with victims redirected across multiple domains before retrieving **MEGA**-hosted archives containing a staged loader. The campaign was not limited to a single piracy site; investigators said similar cracked-software promotions also appeared on platforms such as **TIDAL**, broadening the reach of the infection chain. The analyzed sample used a hijacked DLL, encrypted configuration files, and layered evasion techniques including **module stomping**, **stack spoofing**, **syscall indirection**, anti-analysis checks, and unhooking routines. After establishing persistence and attempting **UAC bypass**, the malware used multiple process-injection paths to deploy a final payload, with **LummaC2** identified as the most commonly observed payload in recent activity, although HijackLoader has previously delivered other malware families as well.
Aug 14, 2026
Researchers linked **PrivateLoader** to a long-running pay-per-install malware ecosystem that used SEO-poisoned sites and cracked-software lures to infect Windows users with password-protected ZIP archives and NSIS installers. The loader was repeatedly observed delivering a wide range of payloads, including **RedLine**, **Vidar**, **SmokeLoader**, **RisePro**, **Qbot**, **Dridex**, **DanaBot**, **TrickBot**, **Kronos**, **LockBit**, **STOP Djvu**, and **Conti**, while related tooling such as **Discoloader** and the Go-based **Anubis Loader** expanded the same distribution chain. Investigations described administration panels used to manage payload links, browser extensions, bot installs, and operator activity, with one panel reportedly overseeing about **20,000 bots** and collecting more than **11 GB** of stealer logs in less than two weeks. Separate reporting showed PrivateLoader also acting as an access broker for other criminal and state-linked operations. Analysts observed it distributing **ColibriLoader** in a campaign tied to **UAC-0113**, a group CERT-UA has associated with **Sandworm**, and later delivering **Socks5Systemz**, a proxy botnet that converted infected Windows hosts into rentable proxies. Bitsight estimated Socks5Systemz had about **10,000 infected systems** and at least **53 servers** supporting command-and-control, telemetry, DNS, and backconnect functions, with customers buying proxy access through a Telegram-linked service for cryptocurrency. Across the reporting, PrivateLoader emerged as a versatile initial-access platform connecting commodity stealers, banking trojans, ransomware, proxy monetization, and higher-end intrusion activity.
Aug 15, 2026