Recent investigations uncovered two unauthenticated GoLoader builder panels located at IP addresses 121.127.246.86 and 118.107.6.148, both operational since at least January 2026. These panels are responsible for generating approximately 468,349 unique polymorphic Windows malware samples through a variety of methods, including steganography and process hollowing. The panels operate without login requirements, providing full API access to users. They actively manage 71 tasks and have been observed sending malicious payloads to a publicly accessible Alibaba Cloud storage bucket hosting 652 files amounting to about 867 MB, which include steganographic PNG carriers, VBS scripts, and Chinese-language social engineering themes targeting cryptocurrency investors.