Fakebat

FakeBat, also known as Eugenloader and PaykLoader, is a unique malware loader that has been observed in several malvertising campaigns. The malware is often used to drop follow-up payloads such as Lumma stealer. It was first noticed on July 25, 2024, via a malicious ad for Calendly, a popular online scheduling application. After a period of absence, FakeBat re-emerged through a malicious Google ad for the productivity application Notion. The malware's command and control infrastructure was found to be running from utd-gochisu[.]com during one instance. The threat actors behind FakeBat have employed sophisticated tactics to distribute the malware, including setting up fake Zoom sites like z00nn.one-platform-to-connect[.]group, info-zoomapp[.]com, zoomnewsonly[.]site, zoonn[.]virtual-meetings[.]cn[.]com, and promoapp-zoom[.]com. These sites host download URLs such as youstorys[.]com/fonts/Zoom-x64.msix, windows-rars[.]shop/bootstrap/Zoom-x64.msix, and scheta[.]site/apps.store/ZoomInstaller.msix, which appear to be legitimate Zoom installers but are actually infected with the malware. The installers have unique identifiers that can be used to track their malicious activity. On January 8, we identified a malvertising campaign using similar tactics previously seen in FakeBat distributions. In these campaigns, an open directory on the same domain shows the location of the Windows payload, which is an MSI installer (FakeBat), and the Mac payload, Atomic Stealer (AMOS). These campaigns show similarities with previous FakeBat activities, indicating that the same threat actors might be involved. This highlights the need for constant vigilance against evolving cyber threats and the importance of secure browsing practices.