GoFlateLoader Uses Massive PE Overlay to Deliver Lumma, Vidar, and StealC Infostealers

Cybersecuritynews •Tushar Subhra Dutta • June 11, 2026

A new malware loader called GoFlateLoader has been quietly spreading across the internet, and what makes it stand out is not how complex it is but how effective a simple trick has made it. Written in the Go programming language, this loader has one job: to decode and drop dangerous information-stealing programs onto a victim’s […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GoFlateLoader Malware Loader Distributes Multiple Infostealers GoFlateLoader, a Golang-based malware loader, is being used to deliver various infostealers, including Lumma, Vidar, StealC, Amatera, and Remus. Its design is simple, employing a manual PE loader without advanced anti-debugging or obfuscation techniques. This loader is spreading widely across the internet, leveraging a massive PE overlay to conceal its payloads. The operational stealth of GoFlateLoader relies on its low-tech approach, making it effective despite its simplicity. Organizations and individuals using Windows systems are particularly vulnerable to these infostealers. The current status indicates ongoing distribution, with no immediate remediation steps provided in the articles. Security professionals are advised to monitor for signs of infection and implement protective measures. 2 sources 49

GoFlateLoader Uses Massive PE Overlay to Deliver Lumma, Vidar, and StealC Infostealers

The full story

Extracted Entities

Attack Types (1)

Malware (3)

MITRE ATT&CK (1)

Tools (1)