Loading story…
Attackers used SEO poisoning and a counterfeit Windows 11 upgrade website to lure users into downloading a malicious ISO file that installed Inno Stealer, an information-stealing malware family. The site copied Microsoft's Windows 11 branding and reportedly served the payload only to users connecting directly, while blocking downloads from TOR and VPN users to reduce scrutiny and evade researchers.
CloudSEK found the campaign used a multi-stage, Delphi-based infection chain that established persistence, weakened security controls, and stole browser credentials, cookies, cryptocurrency wallet data, and files from infected systems. The malware encrypted stolen data before sending it to a command-and-control server and could fetch additional nighttime payloads to expand collection, including clipboard theft and directory enumeration.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
CloudSEK analyzed the multi-stage Delphi-based malware delivered by the fake upgrade site and named it Inno Stealer because it used the Inno Setup installer. The firm reported no code similarities with common commodity stealers and said it had found no evidence of the malware being uploaded to VirusTotal at the time of analysis.
Threat actors ran an active SEO-poisoning campaign that directed users to a fake Windows 11 upgrade site, windows11-upgrade11[.]com, impersonating Microsoft's branding to deliver a malicious ISO. Victims who downloaded and executed the file were infected with a new information-stealing malware later dubbed Inno Stealer.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors set up the spoofed domain **`windows-upgraded[.]com`** to mimic Microsoft's Windows 11 upgrade page and trick Windows 10 users into downloading a malicious archive, **`Windows11InstallationAssistant.zip`**, hosted via a Discord CDN. The lure appeared shortly after Microsoft expanded Windows 11 availability, targeting users eager to upgrade, including those unable to obtain the OS through official channels. Researchers said the downloaded package contained an unusually large padded executable that expanded to about **751 MB**, a tactic likely intended to evade sandbox analysis and security scanning. When launched, the fake installer executed a multi-stage chain using **PowerShell** and **`cmd.exe`**, paused for 21 seconds, fetched a disguised payload named **`win11.jpg`** from a remote server, reversed the file into a DLL, and loaded **RedLine Stealer**. The malware collected host, software, and hardware details, along with browser passwords, autocomplete and credit card data, and cryptocurrency wallet files, then contacted a command-and-control server at **`45.146.166[.]38:2715`** over TCP. HP linked the operation to an earlier fake Discord installer campaign based on shared registrar, DNS infrastructure, delivery methods, and use of the same malware family.
Aug 15, 2026
Multiple reports describe **active malware campaigns targeting Windows users** with a focus on **credential, session, and wallet theft** delivered through social engineering and abuse of legitimate services. **CharlieKirk Grabber**, a Python infostealer packaged with *PyInstaller*, is distributed via phishing, cracked software, cheats, and social-media lures; it kills browser processes (via `TASKKILL`) to access credential stores, collects passwords/cookies/autofill/Wi‑Fi data, zips the loot, uploads it to *GoFile*, and relays the download link to operators via **Discord webhooks** or **Telegram bots**. Separately, attackers are buying **Facebook ads** impersonating Microsoft to drive victims to cloned Windows 11 download pages on lookalike domains (e.g., `ms-25h2-update[.]pro`), delivering a malicious installer that steals saved passwords, browser sessions, and **cryptocurrency wallet** data; the campaign uses **geofencing/sandbox evasion** to show benign content to data-center IPs while serving malware to likely end users. Other contemporaneous activity highlights broader Windows-targeted intrusion tradecraft and adjacent threats. FortiGuard Labs reported **Winos 4.0 (ValleyRat)** phishing campaigns in Taiwan using tax and e-invoice lures, with delivery chains including malicious **LNK** downloaders, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud hosting. In LATAM, a fake bank-receipt lure delivers **XWorm v5.6** via a `.pdf.js` double-extension WSH dropper that uses junk-padding and Unicode obfuscation, then reconstructs and runs PowerShell (spawned via WMI) and abuses trusted hosting (e.g., Cloudinary) for later stages—enabling credential theft and potential ransomware follow-on. Additional reporting covered a USB-propagating **Monero cryptomining** operation capable of crossing air-gapped environments, a new Linux **SysUpdate** variant with encrypted C2 traffic (and a Unicorn Engine-based decryption approach developed during DFIR), and the **Foxveil** loader abusing **Cloudflare Pages, Netlify, and Discord** to stage shellcode and persist via services or *SysWOW64* masquerading—these are separate threats but reinforce the trend of attackers blending into trusted infrastructure and common user workflows.
Jun 29, 2026
Threat actors have been using fake crack, keygen, pirated software, and bogus installer sites to infect users with information-stealing malware, often through SEO poisoning, redirect chains, and password-protected archives hosted on legitimate services such as MediaFire, Discord, and filesend.jp. Reported payloads include **RedLine**, **RecordBreaker**, **Cryptbot**, **CopperStealer**, **Lightning Stealer**, **FFDroider**, **ZingoStealer**, **LUMMASTEALER**, and **IDATLOADER**, with lures ranging from KMSpico activators and fake Telegram installers to cracked copies of TeamViewer, VueScan Pro, Movavi Video Editor, and other popular software. Several campaigns used anti-analysis techniques such as anti-VM checks, obfuscated loaders, process hollowing, DLL sideloading, and in-memory execution to evade detection. The malware families stole browser credentials, cookies, credit card data, Discord tokens, Telegram data, screenshots, desktop files, and cryptocurrency wallet information, while some also hijacked clipboard wallet addresses, redirected exchange traffic through malicious proxy settings, abused stolen Facebook and Instagram business accounts, or downloaded follow-on payloads such as miners and additional stealers. Researchers warned that these infections are often opportunistic because victims actively seek pirated software, but the resulting foothold can enable broader compromise, including persistence, backdoor access, VPN abuse, lateral movement, and resale of access to other criminals or ransomware operators.
Aug 15, 2026