GoFlateLoader Malware Drops Lumma, Vidar, and StealC Payloads

Threat actors are proving that malware does not need to be highly sophisticated to be incredibly effective. The GoFlateLoader malware is a prime example of this growing trend.

Written in Go, this simple loader has a single purpose: to decode and execute malicious payloads directly in a computer’s memory.

Since April 2026, security researchers have blocked this active threat for over 33,000 unique users globally. The campaign has heavily impacted countries like Brazil, India, Argentina, Mexico, Turkey, and Spain.

GoFlateLoader Drops Infostealer Payloads

Unlike advanced malware that uses complex anti-debugging or sandbox-evasion techniques, GoFlateLoader lacks application programming interface (API) hashing and control flow obfuscation.

Instead, it relies on an incredibly simple yet highly effective trick to stay hidden. The loader appends a massive Portable Executable (PE) overlay to the end of its file. This action artificially inflates the binary’s size to 700-950 megabytes.

This deliberate design choice specifically targets the performance constraints of modern security tools. Antivirus software and Endpoint Detection and Response (EDR) solutions often enforce practical file-size limits for deep scanning and emulation to preserve system performance.

Automated scanning pipelines also enforce strict upload limits to manage bandwidth and storage costs. For example, the popular threat intelligence platform VirusTotal restricts file uploads to 650 megabytes.

By keeping its file size intentionally above this threshold, GoFlateLoader successfully evades these cloud-based sandboxes. Attackers fill this massive overlay with null bytes or random padding.

Because this artificially inflated data compresses extremely well in ZIP archives, cybercriminals incur virtually no additional bandwidth costs when distributing the malware across the internet.

Once a victim executes the file, GoFlateLoader follows a short and linear execution path. It reconstructs the final payload entirely in system memory, ensuring the malicious code never touches the physical hard drive.

The malware copies the encoded payload from its data section, decodes it into a valid format, and allocates a new memory region.

After mapping the file and resolving necessary imports, execution is successfully transferred to the hidden payload, gendigital said.

Interestingly, the loader abuses a specific function called syscall. Syscall is a generic call gate to launch the payload. It passes hardcoded filler values specifically 1, 2, 3, and 4 as arguments.

The final payload never uses these numbers, but they provide a unique and recognizable pattern that defenders can use to detect the loader’s activity.

The malware also carries substantial decoy code that changes across different builds to complicate static analysis.

Attackers primarily use GoFlateLoader to distribute prevalent information stealers, including Amatera, Remus, Lumma, Vidar, StealC, and SvitStealer.

Threat actors distribute this loader through two main channels. The first method tricks victims into downloading supposedly cracked software.

The second method uses malicious Traffic Direction Systems (TDS) to redirect victims to a fake landing page. This page offers a downloadable archive and displays the extraction password separately.

This tactic prevents automated security solutions from decrypting and scanning the contents, keeping the payload concealed until the victim manually extracts it.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.