GoFlateLoader Hides Infostealers in Massive PE Overlay

Gbhackers •Mayura Kathir • June 11, 2026

GoFlateLoader, a widespread Golang loader that has become a go-to delivery mechanism for multiple infostealers including Lumma, Vidar, StealC, Amatera and Remus. GoFlateLoader’s design is intentionally unspectacular: its code implements a straightforward in-memory manual PE loader, lacking anti-debugging, anti-VM, API hashing or control-flow obfuscation. The loader’s operational stealth instead relies on an arguably low-tech but […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GoFlateLoader Malware Loader Distributes Multiple Infostealers GoFlateLoader, a Golang-based malware loader, is being used to deliver various infostealers, including Lumma, Vidar, StealC, Amatera, and Remus. Its design is simple, employing a manual PE loader without advanced anti-debugging or obfuscation techniques. This loader is spreading widely across the internet, leveraging a massive PE overlay to conceal its payloads. The operational stealth of GoFlateLoader relies on its low-tech approach, making it effective despite its simplicity. Organizations and individuals using Windows systems are particularly vulnerable to these infostealers. The current status indicates ongoing distribution, with no immediate remediation steps provided in the articles. Security professionals are advised to monitor for signs of infection and implement protective measures. 2 sources 49

GoFlateLoader Hides Infostealers in Massive PE Overlay

The full story

Extracted Entities

Attack Types (1)

Malware (5)