Exposing FakeBat loader: distribution methods and adversary infrastructure

### Executive Summary Sekoia TDR details active FakeBat (EugenLoader/PaykLoader) distribution campaigns in 2023–2024, showing the loader sold as MaaS with a bespoke distribution service and used in large-scale drive-by download operations (malvertising, compromised WordPress fake browser updates, social engineering) to deliver infostealers, loaders, RATs and ransomware; the report includes extensive IoCs (domains, MSIX hashes, PowerShell scripts), observed C2 infrastructure, and YARA rules to aid detection and tracking.