Gootkit is a banking trojan for Windows that targets sectors like finance, law, and healthcare. It steals logins, browser cookies, and payment data, and can pull in extra payloads to widen the breach. Technical details and IOCs - see our Gootkit explainer.
Search poisoning - booby-trapped downloads from fake SEO results
Phishing - invoice or court notice lures with harmful attachments
Bundled installers - repacked software and fake updates
Banking or portal logins ask for unusual extra steps
Odd browser redirects or new extensions you did not add
New scheduled tasks or services - spikes in outbound traffic
Disconnect from the internet and avoid banking on the infected device.
Run a full anti-malware scan, quarantine results, reboot, then scan again.
From a clean device, change passwords and enable MFA for email, banking, and admin accounts.
Check startup items, scheduled tasks, services, and extensions - remove unknowns.
Call your bank to review transactions and set alerts.
Download software only from official sources - avoid repacks and cracks.
Keep Windows, browsers, and Office updated - block macros by default.
Use reputable EDR or anti-malware plus email and web filtering.
Train staff to verify money or account changes out of band.
Consider DNS filtering to block known malicious domains.