New Qbot malware variant uses fake Adobe installer popup for evasion

Researchers observed renewed Qakbot (QBot) activity with up to 10 new builds since mid-December that employ MSI/CAB droppers and a bogus Adobe installer prompt to deploy a DLL; the variants use stronger obfuscation (AES-256 over XOR), perform AV and virtualization checks to evade analysis, and continue to act as loaders for ransomware and other malicious payloads—warranting close monitoring and updated detection rules.