+- Hack Forums (https://hackforums.net)
+-- Forum: General Topics (https://hackforums.net/forumdisplay.php?fid=7)
+--- Forum: World (https://hackforums.net/forumdisplay.php?fid=445)
+---- Forum: News and Happenings (https://hackforums.net/forumdisplay.php?fid=89)
+---- Thread: GootLoader Malware Uses 5001,000 Concatenated ZIP Archives to Evade Detection (/showthread.php?tid=6318532)
GootLoader Malware Uses 5001,000 Concatenated ZIP Archives to Evade Detection - Stanley - Jan 26, 2026
GootLoader Malware Uses 500–1,000 Concatenated ZIP Archives to Evade Detection
The JavaScript (aka JScript) malware loader called GootLoader has been observed using a malformed ZIP archive that's designed to sidestep detection efforts by concatenating anywhere from 500 to 1,000 archives.
"The actor creates a malformed archive as an anti-analysis technique," Expel security researcher Aaron Walton said in a report shared with The Hacker News. "That is, many unarchiving tools
https://thehackernews.com/2026/01/gootloader-malware-uses-5001000.html
RE: GootLoader Malware Uses 5001,000 Concatenated ZIP Archives to Evade Detection - Moooookie - Jan 31, 2026
That’s pretty wild. Using hundreds of zip files just to dodge detection shows how far malware authors will go.