Huntress finds three GootLoader infections since Oct 27, 2025; two led to domain controller compromise within 17 hours.

A suspicious Visual Studio Code extension with file-encrypting and data-stealing behavior successfully bypassed marketplace ...