Gootloader Returns with a New ZIP File Tactic to Conceal Malicious Payloads

Cybersecurity researchers have uncovered a revived Gootloader campaign that uses a novel ZIP file manipulation tactic to conceal malicious payloads. The archive behaves differently depending on the extraction tool: Windows Explorer extracts a malicious JavaScript file (.JS) as the payload, while industry tools like VirusTotal, Python’s zipfile library, or 7-Zip reveal harmless-looking text files that mask the true threat.

The infection now drops two distinct LNK shortcut files, with the first placed in the Startup folder to ensure auto-execution and a second in the AppData directory that actually launches the payload via a dropped JavaScript file. The attackers also rely on custom keyboard shortcuts—Ctrl+Alt plus random letters—to trigger the secondary LNK file, and they simulate keystrokes during infection to start execution.

A gating system tailors what victims see based on location, OS, referrer source, and time, with compromised sites sometimes presenting fake pages such as a Yale Law Journal instance. The campaign distributes thousands of unique search keywords across more than 100 compromised sites to broaden its reach.