New Malware Campaign Exploits Fake Windows Update Sites

A recent malware campaign has been uncovered by security researchers at Malwarebytes Labs, targeting Windows users through a fraudulent clone of a Microsoft website. This campaign primarily aims to steal sensitive personal information, utilizing a convincing yet deceptive web address that resembles a legitimate Microsoft domain. The malware is designed to evade detection by employing advanced techniques and disguises.

Stealthy Malware Campaign Uses Fake Windows Update Site To Infect PCs

The malware installation process incorporates a combination of Electron, JavaScript, and Python, making it difficult to analyze and detect. Notably, VirusTotal reported zero detections across 69 engines for the main executable, indicating its sophisticated evasion tactics. The malware achieves persistence on infected machines through two methods: modifying the Windows registry to add a value called SecurityHealth, mimicking Windows Defender, and placing a shortcut labeled Spotify.lnk in the startup folder to disguise itself as the Spotify application.

Stealthy Malware Campaign Uses Fake Windows Update Site To Infect PCsFake Windows Support website offers 'cumulative update' for version 24H2 but delivers password-stealing malware that can avoid anti-virus detection

Victims are lured to a fake Windows support page that claims to offer a 'cumulative update' for 'Windows Update version 24H2.' This page includes a plausible KB article number and a prominent 'Download the update' button. Users who click this button inadvertently download a malicious package named 'WindowsUpdate 1.0.0.msi,' which is built using the legitimate WiX Toolset framework. This package is designed to extract passwords, payment details, and account access information without raising immediate alarms.

Fake Windows Support website offers 'cumulative update' for version 24H2 but delivers password-stealing malware that can avoid anti-virus detection

One key indicator of the scam is the suspicious domain 'microsoft-update[.]support,' which differs from Microsoft's genuine support hub at 'support.microsoft.com.' Users are advised to download updates directly from the Windows Update section within their operating system's Settings menu, rather than from external websites. Microsoft has also provided guidance on legitimate update procedures to help users avoid falling victim to such scams.

Fake Windows Support website offers 'cumulative update' for version 24H2 but delivers password-stealing malware that can avoid anti-virus detectionStealthy Malware Campaign Uses Fake Windows Update Site To Infect PCs

Malwarebytes has updated its antivirus software to enhance detection capabilities against this new malware variant. They emphasize the importance of vigilance when downloading software and recommend that users verify the authenticity of websites before proceeding with downloads.

Stealthy Malware Campaign Uses Fake Windows Update Site To Infect PCs

While the malware's sophisticated design has drawn attention, critics argue that the responsibility also lies with users to remain cautious and informed about potential online threats. The increasing sophistication of scams raises concerns about the effectiveness of current cybersecurity measures.

Stealthy Malware Campaign Uses Fake Windows Update Site To Infect PCs

As this malware campaign continues to evolve, it is expected that attackers will adapt their strategies to target a broader audience beyond French-speaking users. Ongoing updates from cybersecurity firms like Malwarebytes will be crucial in combating these threats and protecting users.

Stealthy Malware Campaign Uses Fake Windows Update Site To Infect PCs

• “VirusTotal showed zero detections across 69 engines for the main executable,” — Malwarebytes Labs

Stealthy Malware Campaign Uses Fake Windows Update Site To Infect PCs

• “This is not a failure of any single tool. It’s the intended result of the malware’s architecture.” — Malwarebytes Labs

Fake Windows Support website offers 'cumulative update' for version 24H2 but delivers password-stealing malware that can avoid anti-virus detection

This malware campaign highlights the need for increased awareness and proactive measures among users to safeguard their personal information against evolving online threats.

Stealthy Malware Campaign Uses Fake Windows Update Site To Infect PCs