Hiding in the Cloud: GuLoader Malware Evolves to Evade Detection

Zscaler ThreatLabz provides a technical analysis of GuLoader (CloudEye), highlighting how the malware family has evolved since 2019 to evade defenders by using polymorphic and exception-based control-flow obfuscation, hosting payloads on trusted cloud services (Google Drive, OneDrive), and employing multi-layered XOR decryption using an encrypted binary as a key to retrieve final payloads such as RATs and information stealers.