Loading story…
Researchers identified a campaign using at least 41 fake download websites that impersonate popular games and Windows software, including VLC, 7-Zip, Paint.NET, Roblox, PUBG, Counter-Strike, and VMware, to trick visitors into installing Download Studio instead of the product they selected. The pages display convincing product information and even show legitimate destination URLs on hover, but JavaScript intercepts the click and silently redirects users through an affiliate chain to a different installer.
The delivered file analyzed by researchers was a roughly 73 MB Windows executable signed by Grand Media, TOV, which installed Download Studio, enabled automatic updates, and in some cases registered torrent and magnet associations. Researchers said Download Studio was not confirmed as malware in this campaign, but warned that its updater was previously abused in 2020 to distribute the FakeMBAM backdoor and cryptocurrency miners, making the forced-installation tactic especially risky and underscoring the need to obtain software only from official vendor sites or trusted stores.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Avast reported in 2020 that Download Studio's automatic update mechanism was abused to silently deliver the FakeMBAM backdoor disguised as a Malwarebytes installer, along with persistent cryptocurrency miners. Download Studio's developers said they had detected a security incident involving their continuous-integration server or update infrastructure and added security measures.
Malwarebytes researchers identified a network of 41 fake software and game download sites that impersonate legitimate products and use JavaScript to override visible download links. The campaign redirects victims through affiliate tracking and ultimately pushes a signed Download Studio installer instead of the advertised software.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 47 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
heise.de
Open sourcemalware.news
Open sourcemalwarebytes.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers have set up more than 70 lookalike websites impersonating popular Windows utility and customization apps, including **Wintoys**, **PowerToys**, **WinUtil**, **EasyBCD**, **CrystalDiskMark**, **Lively Wallpaper**, and **SignalRGB**, to lure users searching for downloads. The campaign was uncovered after Wintoys developer **Bogdan Pătrăucean** identified a cloned site for his app and traced it to a wider domain cluster linked by the anonymized WHOIS contact `43345@anonymize.com`, with operators reportedly shifting domains to a new registrar after scrutiny. Researchers said the sites use a staged approach: some initially serve legitimate installers to build trust, then later replace them with malicious downloads. Observed payloads include trojanized installers, persistent **ScreenConnect** remote-access software, **RemusStealer**, **AnimateClipper**, and bandwidth-sharing software, while proxy-backed hosting has helped keep parts of the infrastructure online. Some domains have been flagged by **Cloudflare** or added to **Hagezi** blocklists, but many remain active, increasing the risk for users who download Windows apps from search results instead of official developer pages or the Microsoft Store.
Jul 27, 2026
Researchers reported multiple campaigns using fake download and streaming sites to compromise users with remote access tools, malware, and proxyware. Kaspersky found more than 90 spoofed domains in 10 languages promoting bogus Windows software downloads through search engine optimization; the delivered archives used DLL sideloading to install the expected application alongside **ScreenConnect**, then deployed **AsyncRAT** for persistent access. In one investigated case, the attackers altered Microsoft Defender exclusions, disabled User Account Control, and used process hollowing into `RegAsm.exe` to launch the payload, creating risk for both consumers and enterprise networks because remote administration tools are often allowlisted and may run with elevated privileges. A parallel set of campaigns abused demand for free media and utilities to lure victims into installing unwanted software that can expose systems and internet connections to criminal use. Researchers tracking World Cup-themed piracy sites found rotating mirror domains, typosquatting, and cloud-hosted pages pushing fake **Stremio** installers, VPN-themed lures, and affiliate-style downloads tied to malware, phishing, and scams. Separate analysis of a fake **7-Zip** installer showed a Go-based backdoor that converted infected Windows hosts into residential proxy nodes, while broader threat reporting warned that free VPNs, streaming apps, browser extensions, and cheap IoT products are increasingly used to build residential proxy networks that criminals exploit for fraud, scraping, account abuse, and evasion.
Jul 12, 2026
A large-scale campaign has impersonated popular open-source and freeware projects, including **Ghidra**, **dnSpy**, and **SpiderFoot**, to capture search traffic and hijack software download clicks. Researchers found that the fake sites use CloudFront-hosted JavaScript to intercept a visitor’s first interaction and send users into a gated Traffic Distribution System (TDS) that performs anti-bot screening, VPN and datacenter filtering, click confirmation, and frequency capping before deciding what content to serve. The infrastructure appears primarily built for traffic acquisition and monetization, but selected victims were repeatedly routed into malware delivery chains. Those chains included **SessionGate**, a heavily obfuscated multi-stage framework with strong anti-analysis protections that mainly delivered potentially unwanted applications, as well as **RemusStealer** and **AnimateClipper**, which were used to deploy an infostealer and a cryptocurrency clipper. Researchers said the operation has been active since at least late 2025, with active malware distribution observed from early 2026 and more than **5,000** VirusTotal submissions indicating significant scale.
Jun 29, 2026