Gootloader Malware Resurfaces in Google Ads for Legal Docs

Security researchers observed a Gootloader campaign that uses malicious Google Ads targeting legal-document searches to deliver a zipped .js payload which executes, creates scheduled tasks, and runs PowerShell to collect system data and beacon to attacker-controlled domains; known IoCs include lawliner.com and skhm.org and defenders are advised to block those URLs and search historical contacts tied to them.