Researchers found 41 convincing “download” websites that impersonate popular games and Windows apps. The pages show legitimate-looking download links when you hover, but clicking triggers hidden scripting that redirects visitors to install “Download Studio” instead. The installer is validly signed, which can mislead people into thinking they downloaded the software they intended.
Researchers identified a network of 41 impersonation websites advertising popular games and Windows software. Each site was built to look like a legitimate download source, and hovering over the download button displayed a genuine-looking destination such as a Steam Store address or the official VideoLAN download URL. But the visible link was only part of the story. JavaScript on the page intercepted the click, canceled the expected navigation, and redirected the visitor through an affiliate tracking link. Instead of receiving the software they clicked for, users were funneled toward installing a program called Download Studio.
One example impersonated a Grand Theft Auto VI PC download despite no PC version having been announced. Another mimicked a VLC Media Player page with accurate version information and developer details, yet still redirected to Download Studio. In all cases, the redirect happened only after the click, meaning a quick hover check would not have revealed the deception.
The campaign worked because it exploited a common but incomplete safety habit: checking a link's destination by hovering before clicking. The pages displayed accurate, real-world information, correct URLs, correct version numbers, correct developer names, right up until the click itself, which behaved differently from what was shown. The Download Studio installer was also validly signed by Grand Media, TOV, so anyone who checked the file's digital signature after downloading would have seen a legitimate-looking result, reinforcing a false sense of trust even though the delivered software was not what was requested.
The most reliable defense is sourcing software directly from the developer's official website or a trusted app store, such as Steam for games or the publisher's own distribution channel, rather than third-party download pages found through search or ads. A valid digital signature should not be treated as proof that the correct or trustworthy program was downloaded; it only confirms publisher identity and file integrity, not intent or safety. Employees and IT staff should also be trained to stop and close any download page that requires installing a separate download manager before the intended software appears. Because Download Studio's auto-updater has a documented history of being abused to deliver malware, organizations should treat any unexpected download manager prompt as a signal to pause, verify the source, and report the page rather than proceed.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Hovering over the download button showed a genuine destination like Steam or VideoLAN, but JavaScript on the page intercepted the click and redirected the visitor toward an affiliate link that installed Download Studio instead.
No. The Download Studio installer was validly signed by Grand Media, TOV, which shows that code signing confirms publisher information and file integrity but does not guarantee the software is trustworthy or what the user intended to download.
Close the page. Legitimate downloads from the developer's official website or a trusted store like Steam should not require installing a separate download manager before getting the actual software.
The campaign appears to run through affiliate tracking, though Download Studio's auto-updater has a prior history of being abused to deliver malware in a 2020 incident known as FakeMBAM.
You Google a Counter-Strike download, hit a slick page, and the button even shows a real Steam Store link when you hover. You click, but Steam never opens. Hidden JavaScript cancels the real link, bounces you through an affiliate redirect, and drops a 'Download Studio' installer instead. Same trick with a fake VLC page: it displays a real VideoLAN link and correct version info, but the click is hijacked so you install Download Studio, validly signed by 'Grand Media, TOV', not VideoLAN. Remember this: hovering and a valid signature aren’t enough. If a page wants you to install a separate download manager like Download Studio first, stop and close the page.
Microsoft says a Russian-linked group is abusing hotel and conference Wi‑Fi “captive portals” to trick travelers into entering corporate credentials or installing malware. Victims see what looks like a normal Wi‑Fi login flow, but attackers manipulate DNS/website traffic to redirect them to fake…
This roundup describes multiple real-world campaigns where attackers trick people into installing malicious software that looks legitimate (a fake Claude desktop app, a fake emergency alert app, and banking-malware phishing). The common pattern is “looks normal, feels urgent,” leading users to…
Attackers used fake Steam forum replies that looked like helpful troubleshooting steps for real gaming/PC problems. The posts tricked users into running PowerShell as an administrator, which then downloaded and installed the XMRig crypto miner and set it to run automatically at startup. The…
This threat trend report describes multiple real-world APT campaigns where attackers rely on social engineering and trusted services (Zoom/Teams, Telegram, webmail, GitHub) to steal credentials and access cloud accounts. Notable examples include fake meeting lures to deliver malware, and abuse of…
Researchers observed real campaigns using compromised WordPress sites to show fake verification/BSOD-style prompts that trick users into running a copied PowerShell command. The technique (ClickFix) was paired with MaaS tools (ErrTraffic and Cruciferra) to deliver malware while attempting to kill…
Scammers are running professional-looking “AML checker” websites that pretend to screen crypto wallets for suspicious activity, but are designed to trick people into connecting their wallet and approving a malicious transaction. Many impersonate a legitimate service (AMLBot) and use fake progress…
