Guloader Malware Rides Wave of Fake Performance Reports

Guloader malware is being distributed through phishing emails that masquerade as critical HR communications, a campaign highlighted by ASEC, the AhnLab Security Intelligence Center, which recently disclosed the operation. The emails claim to deliver a staff performance review for October 2025 and urge recipients to open an attached file named staff record pdf[.]rar, which contains a compressed NSIS executable named staff record pdf.exe.

When run, the malware connects to a legitimate Google Drive URL to download shellcode, attempting to bypass security filters by using a trusted service. The final payload dropped on the victim’s machine is Remcos RAT, a remote access Trojan that enables keylogging, screenshot capture, and control of webcams and microphones, among other capabilities. The malware communicates with a C2 server at 196.251.116[.]219 over ports 2404 and 5000 to exfiltrate stolen data.

Researchers emphasise vigilance against abuse of legitimate platforms for command and control and advise users to be cautious with emails from unknown sources. According to the report published on 9 January 2026, this approach illustrates how social engineering and disguised attachments can deliver advanced spyware.