Hello again, FakeBat: popular loader returns after months-long hiatus

Malwarebytes observed a malvertising campaign using a spoofed Notion Google ad that delivered the FakeBat loader (aka EugenLoader/PaykLoader), which decrypts and injects a LummaC2 stealer into MSBuild.exe after multi-stage PowerShell execution and AMSI bypass; the report includes detailed TTPs and multiple IOCs (malicious URLs, file hashes, and C2 domains).