The web browser, and search engines in particular, continue to be a popular entry point to deliver malware to users. While Malwarebytes Labs noted a decrease in loaders distributed via malvertising for the past 3 months, today’s example is a reminder that threat actors can quickly switch back to tried and tested methods.
After months of absence, Fakebat (AKA Eugenloader, PaykLoader) showed up on the researchers radar again via a malicious Google ad for the productivity application Notion. FakeBat is a unique loader that has been used to drop follow-up payloads such as Lumma stealer. In this blog post, Malwarebytes Labs researchers detail how criminals are targeting their victims and what final malware payload they are delivering post initial infection.
Read more…
Source: Malwarebytes Labs
Related:
- Hackers access data of 8.8 million people in Denmark in ‘extremely serious’ breach
October 5, 2026
A major cybersecurity breach has exposed the personal data of 8.8 million people in Denmark. Denmark has suffered a major data breach after hackers broke into the country’s national population registry and accessed the personal information of millions of people. The country’s digital affairs minister announced the data breach on Monday, calling it “an extremely serious incident” ...
- ShinyHunters hacker in FBI data theft detained in Jordan, cooperating with bureau
October 3, 2026
A suspected member of the ShinyHunters hacking group, which says it stole data on every FBI employee, was detained in Jordan this week and is cooperating with the FBI, three people familiar with the matter told Reuters. Saif al-Din Khader was detained by Jordanian authorities, the three sources said. Two of them said he was brought ...
- Fortinet sounds the alarm over actively exploited FortiMail zero-day
October 2, 2026
Fortinet is warning customers to lock down FortiMail after attackers started exploiting a critical bug that lets them write files to vulnerable systems without logging in. The flaw, tracked as CVE-2026-104286, carries a CVSS score of 9.8 and affects multiple versions of Fortinet’s email security platform. Fortinet describes the vulnerability as a combination of path traversal and ...
- SMTP is the key: BPFDoor and AVERAT hitting the network edge
October 2, 2026
Rapid7 tracked a set of Linux samples that blend into the software and device conventions of the telecom environments they target. The set spans a newly observed BPFDoor variant, a BPF Rekoobe build seen against South Korean targets, a dropper, and six builds of a Linux implant Rapid7 researchers track as AVERAT, deployed against Taiwanese ...
- Operation KillSwitch: Teenager suspected of leading KillSec ransomware group
October 1, 2026
On 30 September 2026, law enforcement took control of KillSec’s leak site, securing at least 110 terabytes of data against further unauthorised access. The cybercrime group used the site to threaten organisations with the publication of stolen files unless they paid a ransom. The action was part of Operation KillSwitch, an international investigation led by German ...
- ShinyHunters hackers are going after Oracle systems once again
September 29, 2026
ShinyHunters have found a way to bypass a mitigation for a zero-day they previously exploited – so now, not only are they back to abusing the same bug, they’ve even expanded their scope to target a much larger pool of organizations. In June 2026, it was reported that ShinyHunters, the infamous data extortionists, found a Java ...