Loading story…
Threat actors set up the spoofed domain windows-upgraded[.]com to mimic Microsoft's Windows 11 upgrade page and trick Windows 10 users into downloading a malicious archive, Windows11InstallationAssistant.zip, hosted via a Discord CDN. The lure appeared shortly after Microsoft expanded Windows 11 availability, targeting users eager to upgrade, including those unable to obtain the OS through official channels. Researchers said the downloaded package contained an unusually large padded executable that expanded to about 751 MB, a tactic likely intended to evade sandbox analysis and security scanning.
When launched, the fake installer executed a multi-stage chain using PowerShell and cmd.exe, paused for 21 seconds, fetched a disguised payload named win11.jpg from a remote server, reversed the file into a DLL, and loaded RedLine Stealer. The malware collected host, software, and hardware details, along with browser passwords, autocomplete and credit card data, and cryptocurrency wallet files, then contacted a command-and-control server at 45.146.166[.]38:2715 over TCP. HP linked the operation to an earlier fake Discord installer campaign based on shared registrar, DNS infrastructure, delivery methods, and use of the same malware family.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
A malicious actor registered windows-upgraded[.]com to impersonate Microsoft's Windows 11 site and distribute malware. HP tied the registration to the same day Microsoft announced the final phase of the Windows 11 upgrade rollout.
In December 2021, attackers ran a RedLine Stealer campaign using the fake domain discrodappp[.]com to distribute malware disguised as a Discord installer. HP said the later Windows 11 lure shared registrar, DNS infrastructure, delivery style, and malware family with this earlier activity.
By the time the campaign was reported publicly, the observed malware distribution site was no longer online. Researchers warned the operators could quickly register a new domain and resume the activity.
HP Wolf Security publicly documented the fake Windows 11 upgrade campaign, including the oversized padded executable, the win11.jpg payload retrieval, and the RedLine C2 at 45.146.166[.]38:2715. The report also linked the activity to the December 2021 fake Discord installer campaign.
Threat actors used the fake windows-upgraded[.]com site to trick Windows 10 users into downloading Windows11InstallationAssistant.zip from Discord's CDN, which ultimately installed RedLine Stealer. The infection chain used a padded executable, PowerShell and cmd.exe, then fetched a disguised payload and loaded it as a DLL that connected to a C2 server.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 11 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers used SEO poisoning and a counterfeit Windows 11 upgrade website to lure users into downloading a malicious ISO file that installed **Inno Stealer**, an information-stealing malware family. The site copied Microsoft's Windows 11 branding and reportedly served the payload only to users connecting directly, while blocking downloads from TOR and VPN users to reduce scrutiny and evade researchers. CloudSEK found the campaign used a multi-stage, Delphi-based infection chain that established persistence, weakened security controls, and stole browser credentials, cookies, cryptocurrency wallet data, and files from infected systems. The malware encrypted stolen data before sending it to a command-and-control server and could fetch additional nighttime payloads to expand collection, including clipboard theft and directory enumeration.
Aug 14, 2026
Attackers have set up more than 70 lookalike websites impersonating popular Windows utility and customization apps, including **Wintoys**, **PowerToys**, **WinUtil**, **EasyBCD**, **CrystalDiskMark**, **Lively Wallpaper**, and **SignalRGB**, to lure users searching for downloads. The campaign was uncovered after Wintoys developer **Bogdan Pătrăucean** identified a cloned site for his app and traced it to a wider domain cluster linked by the anonymized WHOIS contact `43345@anonymize.com`, with operators reportedly shifting domains to a new registrar after scrutiny. Researchers said the sites use a staged approach: some initially serve legitimate installers to build trust, then later replace them with malicious downloads. Observed payloads include trojanized installers, persistent **ScreenConnect** remote-access software, **RemusStealer**, **AnimateClipper**, and bandwidth-sharing software, while proxy-backed hosting has helped keep parts of the infrastructure online. Some domains have been flagged by **Cloudflare** or added to **Hagezi** blocklists, but many remain active, increasing the risk for users who download Windows apps from search results instead of official developer pages or the Microsoft Store.
Jul 27, 2026
Multiple reports describe **active malware campaigns targeting Windows users** with a focus on **credential, session, and wallet theft** delivered through social engineering and abuse of legitimate services. **CharlieKirk Grabber**, a Python infostealer packaged with *PyInstaller*, is distributed via phishing, cracked software, cheats, and social-media lures; it kills browser processes (via `TASKKILL`) to access credential stores, collects passwords/cookies/autofill/Wi‑Fi data, zips the loot, uploads it to *GoFile*, and relays the download link to operators via **Discord webhooks** or **Telegram bots**. Separately, attackers are buying **Facebook ads** impersonating Microsoft to drive victims to cloned Windows 11 download pages on lookalike domains (e.g., `ms-25h2-update[.]pro`), delivering a malicious installer that steals saved passwords, browser sessions, and **cryptocurrency wallet** data; the campaign uses **geofencing/sandbox evasion** to show benign content to data-center IPs while serving malware to likely end users. Other contemporaneous activity highlights broader Windows-targeted intrusion tradecraft and adjacent threats. FortiGuard Labs reported **Winos 4.0 (ValleyRat)** phishing campaigns in Taiwan using tax and e-invoice lures, with delivery chains including malicious **LNK** downloaders, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud hosting. In LATAM, a fake bank-receipt lure delivers **XWorm v5.6** via a `.pdf.js` double-extension WSH dropper that uses junk-padding and Unicode obfuscation, then reconstructs and runs PowerShell (spawned via WMI) and abuses trusted hosting (e.g., Cloudinary) for later stages—enabling credential theft and potential ransomware follow-on. Additional reporting covered a USB-propagating **Monero cryptomining** operation capable of crossing air-gapped environments, a new Linux **SysUpdate** variant with encrypted C2 traffic (and a Unicorn Engine-based decryption approach developed during DFIR), and the **Foxveil** loader abusing **Cloudflare Pages, Netlify, and Discord** to stage shellcode and persist via services or *SysWOW64* masquerading—these are separate threats but reinforce the trend of attackers blending into trusted infrastructure and common user workflows.
Jun 29, 2026