THREAT ALERT: GootLoader - Large payload leading to compromise (BLOG)

Cybereason Threat Alert describes the GootLoader SEO poisoning campaign that leverages compromised WordPress sites, watering-hole delivery, and large obfuscated JavaScript payloads to install malware, deploy post-exploitation frameworks such as Cobalt Strike and SystemBC, establish persistence via scheduled tasks, and conduct data-stage exfiltration and remote control through C2 infrastructure, with extensive indicators of compromise and recommended mitigations.