GootLoader Malware: A New Threat Evading Detection in North East India

In the ever-evolving world of cyber threats, a new malware named GootLoader has surfaced, posing a significant risk to computer systems. This JavaScript malware, also known as JScript, employs a unique technique to bypass detection, making it particularly insidious.

Anti-Analysis Techniques

GootLoader uses a malformed ZIP archive, concatenating between 500 to 1,000 archives. This technique, according to Expel security researcher Aaron Walton, is an anti-analysis measure designed to thwart detection by unarchiving tools. While many tools are unable to process this file, the default Windows unarchiver can, ensuring that victims can extract and run the malware.

Distribution and Delivery Methods

GootLoader is typically distributed through SEO poisoning tactics or malvertising, targeting users searching for legal templates. These users are often redirected to compromised WordPress sites hosting malicious ZIP archives.

New Tricks

In late October 2025, malware campaigns using GootLoader resurfaced with new tactics. These campaigns leveraged custom WOFF2 fonts with glyph substitution to obfuscate filenames and exploited the WordPress comment endpoint to deliver ZIP payloads.

Infection and Persistence

Once the ZIP archive is double-clicked, it opens the ZIP folder containing the JavaScript payload in File Explorer. Executing the JavaScript file then triggers its execution via "wscript.exe" from a temporary folder. The JavaScript malware creates a Windows shortcut (LNK) file in the Startup folder to establish persistence, ultimately executing a second JavaScript file using cscript.

Countermeasures and Implications

To counter GootLoader, organizations are advised to block "wscript.exe" and "cscript.exe" from executing downloaded content unless necessary. Additionally, using a Group Policy Object (GPO) can ensure that JavaScript files are opened in Notepad by default, instead of executing them via "wscript.exe."

The implications of this malware for North East India are significant, as the region is increasingly reliant on digital platforms for various aspects of life and business. Cybersecurity measures should be strengthened to protect against such threats, ensuring the safety and security of data and systems.