Monday threat intel: malvertising push targets IT admins with trojanized tools, delivers FakeBat and Pikabot loaders
Marcus Webb ·
Ransomware affiliates resumed a malvertising and SEO poisoning campaign over the weekend, placing lookalike ads for IT utilities that drop loader malware such as FakeBat and Pikabot. The activity is hitting U.S. and European workdays early Monday, with lures impersonating PuTTY, WinSCP, AnyDesk, and 7‑Zip to capture clicks from administrators and help desk staff.
This matters because these loaders are a short hop from hands on keyboard intrusions that end in domain wide ransomware. Historical reporting links Pikabot and similar loaders to Black Basta and other Conti lineage operators, who can pivot from a single workstation to Active Directory in hours.
H2: How the intrusion starts
The flow is consistent. Users click a sponsored result or an SEO lifted page, download a trojanized installer, then execute an MSI, LNK, or signed EXE that launches a script runner. Common stages include msiexec pulling a remote package, wscript or powershell with encoded commands, and persistence through scheduled tasks or Run keys. Follow on payloads often fetch Cobalt Strike or Sliver, then deploy legitimate remote management tools to blend in.
Initial access brokers monetize this step by selling RDP or VPN access harvested from these infections. Ransomware operators purchase that access and return quickly with lateral movement using SMB, WMI, and remote service creation. They exfiltrate data with Rclone or MEGA and trigger encryption after hours.
H2: What security teams should do today
Block search ads for software acquisition on managed endpoints. Require downloads from vendor allowlisted domains and verify code signatures and hashes before execution. Enforce application control through WDAC or AppLocker for installers, scripts, and unsigned binaries.
Harden detections for msiexec fetching from external URLs, powershell with base64 or AMSI bypass strings, certutil and curl usage, and creation of new scheduled tasks. Monitor for unexpected installation or beaconing of RMM tools such as AnyDesk, Atera, ScreenConnect, and TeamViewer, and disable silent installs where possible. Remove local administrator rights from daily use accounts and require elevation workflows.
If a machine executed a suspicious installer, isolate it, collect timeline artifacts, and reset credentials used on that host. Hunt for new service accounts, modifications to GPOs, and data staging in temp paths or user profiles.
As long as advertising platforms and SEO can be subverted to impersonate trusted brands, enterprise software acquisition remains an attack surface. Organizations that treat web search as untrusted input and build strict allowlists, procurement pathways, and application control will reduce exposure to these Monday morning access campaigns.