FAKESECURITY

FAKESECURITY is an activity cluster identified by Acronis Threat Research Unit as part of broader abuse of trusted AI ecosystems, specifically Hugging Face, to stage and deliver malware. The cluster used a batch script named CDC1.bat containing an encoded PowerShell blob that downloaded a heavily obfuscated secondary batch script from a Hugging Face repository, including one repository reported as owned by 2i7j732ddi. Observed FAKESECURITY tradecraft includes extracting a hidden base64 PowerShell payload from its own file, removing Mark-of-the-Web metadata to bypass Windows SmartScreen protections, establishing persistence via a Run key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run, creating a mutex named was_s2Pd8zz_Mtx, XOR-decrypting shellcode, and injecting that shellcode into explorer.exe. The malware also maintained execution with a watchdog loop and dropped a malicious payload masquerading as Windows Defender or Windows Security. The activity is described as malware distribution through Hugging Face-hosted staging infrastructure rather than attributed in the provided content to a specific nation-state or formal intrusion set. Known alias in the provided content: fakesecurity.