BATLOADER- Evasive Malware leverages SEO poisoning

Threat Level

Attack Report

For a detailed threat advisory, download the pdf file here

Summary

“BatLoader” dropper is used to dispense a range of malware tools on victim devices, including a banking Trojan, an information stealer, and the Cobalt Strike post-exploit toolkit. BatLoader malware actors utilize SEO poisoning to dupe potential victims into downloading malicious Microsoft Windows Installer (.msi) files that masquerade as legit software installers.