FakeBat: Loader-as-a-Service Riding Google Search Ads

FakeBat is a widely distributed loader sold as a loader-as-a-service on Russian-speaking forums. It is delivered chiefly through malvertising — malicious Google search ads — and typosquatted software-download sites that serve trojanized installers impersonating popular applications. Since around September 2023, operators moved to signed MSIX installers that abuse the MSIX startScript configuration to run a script before the decoy app launches. It profiles the host and hands off to commodity stealers, bankers and RATs. It is also tracked as EugenLoader and, by Google, as NUMOZYLOD (operation UNC4536).

Overview

FakeBat was first advertised on the Exploit forum in December 2022 as a loader-as-a-service under the seller handle “Eugenfest” (also Payk_34), and Google and Mandiant track the operation as UNC4536. Rental pricing reported via Sekoia (treat as reported) was around $1,000 per week and $2,500 per month for the MSI format. Observed follow-on payloads include IcedID, Lumma, RedLine, SmokeLoader, SectopRAT, Ursnif and a Carbanak build tied to FIN7 — payloads vary by customer.

How It Works

• Trojanized MSIX installers: the MSIX startScript runs an attacker script before the legitimate decoy app launches, reducing suspicion. T1204.002 T1059
• Code-signed installers used to help bypass SmartScreen and reputation warnings. T1553
• Host reconnaissance: OS details, domain-join status, installed security products and, in some variants, public IP. T1082 T1518.001
• C2-side filtering by User-Agent, IP and geolocation to serve payloads selectively and dodge sandboxes; persistence via a Startup-folder shortcut. T1547.001

Delivery

FakeBat arrives through malicious Google ads impersonating popular software — reported lures include Microsoft Teams, OneNote, AnyDesk, Chrome, Brave, KeePass, Notion, Zoom and Steam — and through typosquatted download and fake-browser-update sites. T1583.008 T1036

MITRE ATT&CK Mapping

Detection & Mitigation

• Curate software downloads to trusted sources and deploy ad-blocking at the enterprise edge; apply application control for MSIX and AppX provenance.
• Alert on an MSIX or AppX install immediately spawning a PowerShell or cmd child before the decoy app window appears, and on new Startup-folder shortcuts created by installers.
• EDR detections for post-install reconnaissance and beaconing to freshly registered domains that vary responses by User-Agent and geolocation.