Loading story…
Attackers have set up more than 70 lookalike websites impersonating popular Windows utility and customization apps, including Wintoys, PowerToys, WinUtil, EasyBCD, CrystalDiskMark, Lively Wallpaper, and SignalRGB, to lure users searching for downloads. The campaign was uncovered after Wintoys developer Bogdan Pătrăucean identified a cloned site for his app and traced it to a wider domain cluster linked by the anonymized WHOIS contact 43345@anonymize.com, with operators reportedly shifting domains to a new registrar after scrutiny.
Researchers said the sites use a staged approach: some initially serve legitimate installers to build trust, then later replace them with malicious downloads. Observed payloads include trojanized installers, persistent ScreenConnect remote-access software, RemusStealer, AnimateClipper, and bandwidth-sharing software, while proxy-backed hosting has helped keep parts of the infrastructure online. Some domains have been flagged by Cloudflare or added to Hagezi blocklists, but many remain active, increasing the risk for users who download Windows apps from search results instead of official developer pages or the Microsoft Store.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
After an initial report on the fake-site cluster, the domain portfolio was moved to a new registrar, indicating an operational change to keep the infrastructure online.
Confirmed malicious impersonation sites were seen delivering trojanized installers and additional payloads including persistent ScreenConnect remote access software, RemusStealer, AnimateClipper, and bandwidth-sharing software.
Analysis tied the operation to a large portfolio of over 70 fake software-download domains, including sites impersonating tools such as Wintoys, PowerToys, WinUtil, EasyBCD, CrystalDiskMark, Lively Wallpaper, and SignalRGB.
Bogdan Pătrăucean, the developer of Wintoys, found a clone domain impersonating his application, which led to the broader discovery of the campaign infrastructure.
Some of the impersonation domains were flagged by Cloudflare or added to Hagezi’s DNS blocklist, although many of the sites reportedly remained active.
Check Point Research reported that the impersonation sites initially present legitimate downloads to appear benign, then later replace them with malicious payloads to infect visitors.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcewindowslatest.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported multiple campaigns using fake download and streaming sites to compromise users with remote access tools, malware, and proxyware. Kaspersky found more than 90 spoofed domains in 10 languages promoting bogus Windows software downloads through search engine optimization; the delivered archives used DLL sideloading to install the expected application alongside **ScreenConnect**, then deployed **AsyncRAT** for persistent access. In one investigated case, the attackers altered Microsoft Defender exclusions, disabled User Account Control, and used process hollowing into `RegAsm.exe` to launch the payload, creating risk for both consumers and enterprise networks because remote administration tools are often allowlisted and may run with elevated privileges. A parallel set of campaigns abused demand for free media and utilities to lure victims into installing unwanted software that can expose systems and internet connections to criminal use. Researchers tracking World Cup-themed piracy sites found rotating mirror domains, typosquatting, and cloud-hosted pages pushing fake **Stremio** installers, VPN-themed lures, and affiliate-style downloads tied to malware, phishing, and scams. Separate analysis of a fake **7-Zip** installer showed a Go-based backdoor that converted infected Windows hosts into residential proxy nodes, while broader threat reporting warned that free VPNs, streaming apps, browser extensions, and cheap IoT products are increasingly used to build residential proxy networks that criminals exploit for fraud, scraping, account abuse, and evasion.
Jul 12, 2026
Threat actors are abusing **software-brand impersonation** to trick users into installing malware from fake distribution points, relying on social engineering rather than software exploits. Datadog reported an active campaign using **fake GitHub repositories** that impersonate established technology companies and leverage the **ClickFix** technique—prompting victims to copy/paste commands into *Terminal* (macOS) or *PowerShell/Run* (Windows)—to install infostealers. Datadog observed iterative updates to the *MacSync* lure and a new macOS infostealer variant self-branded as **“SHub Stealer v2.0”**, with expanded capabilities including **persistence** and **remote access**, alongside anti-analysis/evasion features intended to hinder detection and track infection outcomes; Datadog also assessed signs the actor is expanding toward **Windows infostealer** functionality. Separately, Malwarebytes documented a lookalike **7-Zip** download site (`7zip[.]com`, impersonating the legitimate `7-zip.org`) distributing a **trojanized installer** that installs a working 7-Zip File Manager while silently converting infected Windows systems into **residential proxy nodes**. The installer was **Authenticode-signed** with a certificate issued to **Jozeal Network Technology Co., Limited** (now revoked), and it dropped additional components—`Uphero.exe` (service manager/update loader), `hero.exe` (Go-compiled proxy payload), and `hero.dll`—under `C:\Windows\SysWOW64\hero\`; one reported case surfaced via Microsoft Defender detection `Trojan:Win32/Malgent!MSR` after the system had been exposed for an extended period. Together, the reporting highlights a sustained risk from **trusted-brand impersonation** and “looks legitimate” installers/repositories that deliver credential theft or monetize endpoints via proxyware.
Jul 2, 2026
Threat researchers reported separate malware campaigns that used fake or pirated software distribution channels to infect Windows users with credential theft and traffic-interception malware. In one campaign, attackers seeded cracked software sites with a trojanized `WinX_DVD_Copy_Pro.exe` that launched an obfuscated HTA through `MSHTA`, deployed an upgraded **CountLoader v3.2**, and ultimately delivered **ACR Stealer** entirely in memory. The loader established persistence with scheduled tasks, profiled infected hosts, authenticated to command-and-control with a JWT token, and supported additional payload delivery through ZIP, DLL, MSI, PowerShell, and removable-media propagation tasks. A second campaign abused interest in **DeepSeek-R1** by promoting a fake DeepSeek site through Google Ads and delivering a malicious installer, `AI_Launcher_1.21.exe`, backed by fake CAPTCHA pages, PowerShell, AES-decrypted payloads, and a domain-generation routine. The final malware, **BrowserVenom**, installed a rogue root certificate and reconfigured browsers to send traffic through the attacker-controlled proxy `141.105.130[.]106:37121`, allowing interception and collection of user web activity. Researchers said the operations relied on impersonation-themed infrastructure and low-detection payloads to evade defenses, with BrowserVenom infections observed in Brazil, Cuba, Mexico, India, Nepal, South Africa, and Egypt.
Aug 14, 2026