PikaBot Resurfaces with Streamlined Code and Deceptive Tactics

Zscaler researchers observed a new development cycle for PikaBot (v1.18.32) where the operators simplified obfuscation, changed network command/encryption behavior, and stored the bot configuration in plaintext memory; PikaBot is being distributed via phishing and malvertising as an initial-access loader/backdoor used to drop tools like Cobalt Strike. The report also references a Proofpoint disclosure of an active Azure account-takeover campaign using tailored phishing to harvest credentials for exfiltration, internal/external phishing, and financial fraud.