Gootloader malware returns with fake NDA scam - here's what we know

World Password Day 2025.

• Gootloader malware resurfaces using malvertising and SEO poisoning to spread infections
• Attackers now obfuscate malware names using deceptive web fonts and glyph swapping
• Loader delivers ransomware, infostealers, and Cobalt Strike via compromised search results

The Gootloader malware scam, which was thought to have been disrupted and shut down in March 2025, has returned with both old, and new tricks, experts have warned.