Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
GoFlateLoader Malware Drops Lumma, Vidar, and StealC Payloads
Malware Families
Excerpt
Threat actors are proving that malware does not need to be highly sophisticated to be incredibly effective. The GoFlateLoader malware is a prime example of this growing trend. Written in Go, this simple loader has a single purpose: to decode and execute malicious payloads directly in a computer’s memory. Since April 2026, security researchers have blocked this active threat for over 33,000 unique users globally. The campaign has heavily impacted countries like Brazil,…
Read the original report →Diamond Model
Adversary
Infrastructure
Capability(3)
Victim
Attack Flow5 steps · MITRE ATT&CK mapped
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | ed5ae7f36453c5a23e9868a5729d67e0549a11f6dea54f5f52d654a8f51d4902 | Medium | Score 53/100 | First seen |
| SHA256 | b88c5744975d2abb447aecc6c090fee9f8580413f4612eecdc6ed1973e8a1739 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…