Gootloader malware now uses “ZIP bomb” tactic to evade detection

Back Cyberinsider

Gootloader malware now uses “ZIP bomb” tactic to evade detection

Cyberinsider • January 15, 2026

Share: View original

The Gootloader malware now uses a deliberately malformed ZIP archive designed to bypass antivirus detection and thwart analysis workflows.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Gootloader Malware Evades Detection with Malformed ZIP Archives Gootloader, a malware loader used for initial access in ransomware attacks, employs a malformed ZIP archive to evade detection. This archive, which contains a JScript file, causes common unarchiving tools like 7zip and WinRAR to fail, while the default Windows utility can unpack it. This technique involves concatenating up to 1,000 archives to further complicate analysis. 5 sources 44

Extracted Entities

Attack Types (1)

Malware (1)