Fakebat

FakeBat is a notable malware variant that has been increasingly involved in malvertising campaigns since at least November 2022, as per an early 2023 Intel471 report. This malicious software exploits and damages computers or devices by infiltrating systems through suspicious downloads, emails, or websites. Unlike conventional malware strains, FakeBat utilizes MSIX installers bundled with heavily obfuscated PowerShell code, making it a unique threat. It is distributed via deceptive ads for popular software downloads, often disguised as legitimate Zoom download sites such as z00nn.one-platform-to-connect[.]group, info-zoomapp[.]com, and others. The malware is downloaded from URLs like youstorys[.]com/fonts/Zoom-x64.msix and windows-rars[.]shop/bootstrap/Zoom-x64.msix, among others. The FakeBat loader has been observed in various malvertising campaigns, often paired with the Atomic Stealer malware. It communicates with its command and control server (C2) at 2311foreign[.]xyz. In one campaign, the threat actor tracked victims using a newly identified panel, Hunting panel 1.40. An open directory on the same domain revealed the location of the Windows payload, which is an MSI installer (FakeBat), and the Mac payload (Atomic Stealer). Sophos linked FakeBat with infostealers like Redline, Ursniff, and Rhadamathys in a July 2023 report. In recent weeks, FakeBat malvertising campaigns have used two types of ad URLs and targeted many different brands. Its continued presence poses a significant threat to businesses. Malwarebytes has been tracking this malware family closely, documenting its activities in several blog posts. Despite ongoing efforts to mitigate its effects, FakeBat remains a potent adversary in the cybersecurity landscape due to its sophisticated tactics and heavy utilization of obfuscated code.