The Gootloader malware scam, which was thought to have been disrupted and shut down in March 2025, has returned with both old, and new tricks, experts have warned.

Huntress finds three GootLoader infections since Oct 27, 2025; two led to domain controller compromise within 17 hours.

The cybercriminals behind GootLoader malware have launched another campaign that employs misleading font rendering to trick users into downloading malware. Security experts caution that this renewed ...