New Malvertising Campaign Distributing PikaBot Disguised as Popular Software

Malicious Google search ads are being used to distribute the PikaBot loader (and other loaders such as FakeBat and HiroshimaNukes) by redirecting victims to fake download sites that fingerprint visitors and deliver malicious MSI installers (hosted on services like Dropbox). The campaigns—linked to TA577 and observed delivering Cobalt Strike via PikaBot—use multiple sandbox-evasion checks and may represent a malvertising-as-a-service model; the report also details ParaSiteSnatcher, a Chrome extension framework that intercepts and exfiltrates POST data, highlighting both browser- and extension-based theft vectors.