Microsoft reports an active campaign where attackers set up counterfeit software download pages that mimic well-known brands and trick users into installing malware. Victims visit a look-alike vendor site, click “Download now,” then run a bundled installer that drops persistent malware and connects to attacker-controlled servers. The activity primarily impacts China-based operations of multinational organizations and Chinese-speaking users across many industries.
This campaign relies on counterfeit software download pages that closely mimic well-known vendors. Victims typically search for a popular application or driver, land on a high-fidelity look-alike site, and are presented with a prominent Download now button. Clicking it delivers a ZIP archive from rotating delivery hosts. Notably, the archive filename stays consistent across downloads while the file hash changes, suggesting the payload is regenerated server-side each time.
Once extracted and run, the archive's wrapper installer drops a stage-one payload into randomized paths, often under world-writable or system locations such as C:\Users\Public. The executable names follow generated patterns, making them harder to flag through simple allowlists or signature matching.
The look-alike pages clone real product branding closely enough to pass a casual glance, and the domains embed the real brand name even though they are not official vendor domains. This makes the sites convincing to users searching for legitimate software or drivers. The campaign also spans a large, uniform set of vendor impersonations, increasing the odds that a given user's search lands on one of the fraudulent pages rather than the genuine vendor site.
After installation, the malware establishes persistence through scheduled tasks with names that imitate routine IT or productivity jobs, such as "Deadline Mission Target." This blends the malicious activity into normal-looking system administration and reduces the chance a user or admin notices anything unusual.
Organizations should reinforce that software should only be downloaded from official vendor sites or approved internal portals, regardless of how convincing an unfamiliar page looks. Employees should be encouraged to report suspicious download pages or unexpected installer behavior to security teams rather than proceeding on their own.
On the technical side, enabling protections such as SmartScreen, network protection, tamper protection, and Microsoft Defender XDR helps reduce the impact of a malicious download that does get through. Combining user awareness with these endpoint protections addresses both the social engineering entry point and the technical execution stage of this type of campaign.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers clone legitimate vendor pages with a prominent Download now button. When clicked, users receive a ZIP archive containing a wrapper installer that drops persistent malware on the device.
Look-alike domains that embed the brand name but use unusual suffixes, download files coming from unrelated third-party hosts, and archive filenames that stay similar even though the underlying content changes on each download.
It creates scheduled tasks with legitimate-sounding names that repeatedly relaunch payloads, and it can create Microsoft Defender exclusions using a short-lived task running as SYSTEM to weaken defenses.
The activity primarily impacts China-based operations of multinational organizations and Chinese-speaking users across industries including healthcare, manufacturing, gaming, technology, logistics, government, and higher education.
You Google a driver, land on a Razer download page, big green “Download now” button… looks perfect, right? Behind that button is a fake download site. It pulls a ZIP called app_setup.6653004.zip from gehie246.com, then a wrapper installer hides malware in C:\Users\Public\random-folder and C:\ProgramData, and phones home to an Alibaba Cloud OSS bucket. On infected machines we see weird scheduled tasks like “Deadline Mission Target” or “Hierarchy Tools Smooth Inventory” that keep relaunching those files, while a short-lived SYSTEM task quietly weakens Defender with exclusions. If you see a download page on a look-alike domain like app-microsoft-edge.com.cn or pc-razerzone.com.cn, don’t click, close it and grab the software only from the official vendor site or our approved portal.
Researchers report real-world campaigns targeting European government and diplomatic organizations using diplomatic-themed Microsoft Word documents. Victims are prompted to click “Enable Content,” which runs malicious macros that install the HOOKEDGE backdoor and connect to webhook-based…
A real malware campaign used compromised websites to show fake CAPTCHA/verification pages that tricked people into copying and running a PowerShell command themselves. That manual “copy/paste” step helped the attackers bypass normal download defenses and install the Cruciferra loader, which then…
FortiGuard Labs reports an active phishing operation (“TTF Trap”) where emails posing as invoices, shipping documents, or business proposals deliver an archive that ultimately runs malware on Windows. The trick is a file ending in .ttf (TrueType font) that is actually a malicious script executed by…
Microsoft observed real-world campaigns where victims were tricked by “ClickFix” prompts into pasting a command into Windows Run, which then installed ACR (Amatera) Stealer. The malware steals saved browser passwords, live session tokens, and Microsoft 365/OneDrive/SharePoint files, meaning…
Investigators described a real, long-running SEO poisoning operation (“BengalSEO”) that manipulates search results to push victims to fake support and activation pages. The pages impersonate well-known consumer brands, then route visitors through redirects and CAPTCHA checks to either download…
Researchers say the Iran-linked group Nimbus Manticore posed as recruiters on LinkedIn and job platforms to send developers “technical challenge” ZIP files that secretly installed cross-platform remote access trojans. The lures used urgency (short test windows) and realistic developer workflows…
