Once used exclusively by the cybercriminals behind REVil ransomware and the Gootkit banking trojan, GootLoader and its primary payload have evolved into an initial access as a service platform—with Gootkit providing information stealing capabilities as well as the capability to deploy post-exploitation tools and ransomware.
GootLoader is known for using search engine optimization (SEO) poisoning for its initial access. Victims are often enticed into clicking on malicious adware or links disguised as legitimate marketing, or in this case a legitimate Google search directing the user to a compromised website hosting a malicious payload masquerading as the desired file. If the malware remains undetected on the victim’s machine, it makes way for a second-stage payload known as GootKit, which is a highly evasive info stealer and remote access Trojan (RAT) used to establish a persistent foothold in the victim’s network environment.
Read more…
Source: Sophos
Related:
- ShinyHunters hackers say they breached FBI, stole data on bureau employees
September 22, 2026
The digital extortion group known as “ShinyHunters” said on Tuesday that it had breached the Federal Bureau of Investigation and stolen data on a huge number of current and former FBI employees. The bureau did not respond to repeated messages seeking comment on Tuesday. In a statement posted to its dark-web site and during an online chat ...
- Meta Muse already has a majorly worrying zero-day security issue
September 22, 2026
Meta’s new Artificial Intelligence (AI) assistant Muse reportedly carried a zero-day vulnerability that allowed attackers to gain access to people’s apps, such as WhatsApp or email. However, it’s not as straightforward as your usual zero-day – to exploit it, simply deploying malware will not suffice. Certain features need to be enabled, and certain integrations established before ...
- Unmasking EvilTokens: Getting to the root of device code phishing
September 22, 2026
Following its emergence in February 2026, EvilTokens quickly became one of the most widely used phishing-as-a-service (PhaaS) platforms, providing cybercriminals with AI capabilities for tailoring phishing lures and analyzing compromised inboxes to identify high-value targets. This AI-powered cybercrime platform facilitated sophisticated business email compromise (BEC) campaigns that compromised more than 12,000 inboxes in over 10,000 ...
- Google’s Gemini is the latest AI model to hack other companies
September 19, 2026
Google’s Gemini accessed the protected systems of three other companies in what The Wall Street Journal reports were the AI model’s first autonomous hacks. Similar to OpenAI’s breach of Hugging Face, the Gemini hacks were less noteworthy for being particularly sophisticated and more for the fact that they were conducted by an AI model. These breaches ...
- FBI, Coast Guard boarded hacked oil tankers heading toward US coast
September 18, 2026
Cybersecurity teams with the U.S. Coast Guard and the FBI boarded two U.S.-bound oil tankers last month after hackers reportedly compromised at least one of the ship’s networks and took control of its navigation, propulsion, and cargo systems. According to a joint statement shared with TechCrunch, the agencies boarded the vessels in the Gulf of Mexico ...
- Fake parcel delivery messages steal your card and bank details
September 18, 2026
Parcel delivery phishing campaigns appear around the world under different courier names. In the United States, the messages commonly impersonate USPS and claim that a package has an invalid address or could not be delivered. Similar messages impersonate Colissimo and Chronopost in France, Correos in Spain, Poste Italiane in Italy, and PostNL in the Netherlands. The ...