Hackers Spread GoFlateLoader Through Cracked Software and Malicious TDS Campaigns

Sometimes the most effective malware relies on blunt force rather than technical elegance. GoFlateLoader is a simple, Go-based in-memory loader that deliberately inflates its file size to bypass security scanners.

Despite lacking advanced anti-debugging, anti-VM, or sandbox-evasion techniques, it has successfully targeted over 33,000 users since April 2026.

The campaign heavily impacts users across Brazil, India, Argentina, Mexico, Turkey, and Spain.

Cracked Software Spreads GoFlateLoader

GoFlateLoader operates with a straightforward, linear execution flow that reconstructs the payload entirely in memory so it never touches the disk.

It copies an encoded payload blob from the .rdata section to the stack, decodes it into a valid Portable Executable (PE), and allocates read-write-execute memory.

After mapping the payload and rebuilding the Import Address Table, the loader executes the malware’s final stage using Go’s syscall. Syscall function.

The malware abuses this system call as a generic call gate. It points the function to the payload’s entry point and fills the required parameters with dummy arguments.

The loader consistently sets these arguments to the hardcoded values 1, 2, 3, and 4, providing a strong detection opportunity for threat hunters.

The loader’s true evasion capability stems from a massive PE overlay appended to the end of the file. By packing the binary with null bytes or random padding, attackers inflate the file size to 700-950 MB.

This bloated size deliberately crashes automated analysis pipelines and bypasses cloud-based sandboxes. For example, VirusTotal imposes a strict 650 MB upload limit, making the inflated GoFlateLoader easily evade detection on the platform.

Because the padding compresses highly efficiently, attackers face virtually no bandwidth penalties during distribution.

According to gendigital research, attackers distribute these payloads through two main vectors: repackaged cracked software and malicious Traffic Direction Systems (TDS).

When using a TDS, victims are redirected to a landing page offering a downloadable archive. The page separately displays a password needed to extract the contents.

This extra step prevents automated antivirus and EDR solutions from decrypting the archive, keeping the massive GoFlateLoader hidden until the user manually triggers the extraction.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.