GootLoader Malware Uses 500–1,000 Concatenated ZIP Archives to Evade Detection

The Hacker News reports that the GootLoader JavaScript loader is now observed using a malformed ZIP archive that concatenates between 500 and 1,000 archives to evade detection. According to Expel, the attacker creates this anti-analysis archive so many unarchiving tools fail, while the Windows default unarchiver can still open it, enabling the victim to extract and run the JavaScript payload.

The campaigns have previously relied on SEO poisoning or malvertising to target users seeking templates, delivering secondary payloads such as ransomware, and the malware has been seen in the wild since at least 2020. In late October 2025, campaigns resurfaced with new tricks, including custom WOFF2 fonts for obfuscation and exploitation of the WordPress comment endpoint to deliver ZIP payloads when a user clicks a download button.

Expel’s findings describe hashbusting techniques that randomise the number of concatenated files and other ZIP fields so each recipient receives a unique archive, complicating cross-environment hash checks. Once a ZIP is opened, the loader executes via wscript.exe, creates a Startup folder LNK for persistence, and uses cscript to run further PowerShell commands to advance the infection.

To counter this, organisations are advised to block wscript.exe and cscript.exe for downloaded content and use GPOs to open JavaScript files in Notepad by default.