Loading story…
Attackers set up a typosquatted domain, get.activate[.]win, closely resembling the legitimate Microsoft Activation Scripts (MAS) domain, to distribute malicious PowerShell scripts. Users who mistyped the official MAS activation URL were infected with the Cosmali Loader malware, which deployed additional payloads such as cryptomining utilities and the XWorm remote access trojan (RAT). The campaign exploited the popularity of the open-source MAS tool, which is used to automate Windows and Office activation, by relying on a single-character typo to trick users into visiting the malicious site.
Security researchers discovered that the Cosmali Loader's control panel was insecure, allowing third parties to access compromised systems. Some researchers used this access to notify victims of their infection via pop-up warnings. The incident highlights the risks associated with using unofficial activation tools and the dangers of typosquatting, as well as the potential for malware to be distributed through seemingly minor user errors during software activation processes.
Trace attribution and downstream blast radius.
3 events from the most recent confirmed update back to the earliest known activity.
Following disclosure of the typosquatting attack, MAS project maintainers and security experts advised users not to run remote code from unofficial sources and to carefully verify commands to avoid similar infections. The case was highlighted as another example of malware being distributed through unofficial Windows activation tools.
Security researchers including RussianPanda and Karsten Hahn analyzed the campaign and found the malware's control panel was insecure. This allowed a researcher to send pop-up warnings to infected victims, revealing the scope and mechanics of the operation.
Attackers registered and used the typosquatted domain get.activate[.]win to impersonate the legitimate Microsoft Activation Scripts (MAS) site. Users who mistyped the MAS command executed malicious PowerShell that installed Cosmali Loader, which then deployed cryptomining tools and the XWorm RAT.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are using **compromised or spoofed websites** to trick victims into executing malware, with lures ranging from fake browser updates to counterfeit security-software download pages. Recorded Future’s Insikt Group reported that financially motivated **GrayCharlie** (overlapping with **SmartApeSG**) compromised multiple U.S. law-firm WordPress sites—potentially via a shared IT/marketing provider—and injected externally hosted JavaScript that redirected visitors to **bogus update pages** or **fake CAPTCHA** flows. Victims were prompted to run a PowerShell command via the Windows Run dialog, leading to **NetSupport RAT** installation and follow-on delivery of **Stealc** and **SectopRAT**; the operation’s infrastructure was noted as being supported by **MivoCloud** and **HZ Hosting Ltd.** Separately, Malwarebytes-linked reporting described a **typosquatting** campaign impersonating the Huorong antivirus site (`huoronga[.]com` vs. `huorong.cn`) to distribute **ValleyRAT** (built on the **Winos4.0** framework), attributed to the Chinese-speaking **Silver Fox APT**; the payload was routed through an intermediary domain and hosted on **Cloudflare R2**, with a ZIP masquerading as Huorong (`BR火绒445[.]zip`). In a different region and access vector, Group-IB reported Iran-linked **MuddyWater** running **Operation Olalampo** against MENA targets using **phishing emails** with malicious Office documents/macros to deploy new tooling including **GhostFetch** (dropping **GhostBackDoor**) and **CHAR** (a Rust backdoor controlled via a **Telegram bot**), plus variants using **HTTP_VIP** to deploy *AnyDesk*; the campaign also leveraged recently disclosed vulnerabilities on public-facing servers for initial access.
Jun 29, 2026
Threat researchers reported multiple active campaigns focused on **stealthy malware delivery** by abusing trusted execution paths and deceptive distribution. Trellix described attackers using **DLL side-loading** against a legitimate, signed `ahost.exe` binary associated with the *c-ares* ecosystem (commonly seen with GitKraken Desktop) by placing a malicious `libcares-2.dll` alongside the executable to trigger search-order hijacking and execute attacker code. The activity was linked to delivery of commodity malware families including **Agent Tesla, Formbook, Remcos RAT, Quasar RAT, DCRat, XWorm, Vidar Stealer, Lumma Stealer, CryptBot**, and others, with targeting observed across business functions (finance, procurement, supply chain, administration) and lures in multiple languages, suggesting regionally focused operations. Separately, Malwarebytes documented a **fake RustDesk download site** (`rustdesk[.]work`) that installs legitimate RustDesk while silently deploying a persistent backdoor framework (**Winos4.0**) via a trojanized installer (e.g., `rustdesk-1.4.4-x86_64.exe`), relying on user deception rather than exploiting a software vulnerability. Sucuri detailed a WordPress compromise where attackers modified `index.php` to perform **selective content injection/SEO cloaking**, using IP-verified logic with hardcoded **Google ASN CIDR ranges** to serve malicious content to Googlebot while showing normal content to human visitors and site owners—an evasion technique that can facilitate downstream malware distribution while reducing the chance of detection.
Jun 29, 2026
HP Wolf Security reported a targeted malware campaign against the African banking sector in which an employee of a West African bank was lured with a fake recruitment email sent from typosquatted banking domains. The attackers cloned banking websites and used domains configured with **SPF** to make the messages appear more trustworthy, increasing the likelihood of successful delivery and user engagement. The infection chain used **HTML smuggling** to reconstruct a Base64-encoded ISO file from an HTML attachment on the victim’s device, helping the payload evade email and web filtering. Opening the ISO exposed a malicious VBS script that launched PowerShell and executed shellcode from the Windows Registry in memory; that shellcode decrypted to **GuLoader**, which was configured to fetch a **RemcosRAT** payload from cloud services including **OneDrive** and **Dropbox**.
Aug 15, 2026