Nov 122025 GootLoader Is Back, Using a New Font Trick to Hide Malware on WordPress Sites Huntress finds three GootLoader infections since Oct 27, 2025; two led to domain controller compromise within 17 hours.