Over 70 Websites Posing as Popular Software Downloads Caught Distributing Malware
More than 70 websites imitating popular Windows software have been identified as distributors of malware. The proliferation of AI has lowered the barrier for creating deceptive sites, putting users at risk.
Users downloading software for Windows are facing a new threat, with over 70 websites revealed to be distributing malware by impersonating legitimate software download portals. Tools such as PowerToys, CrystalDiskMark, and Lively Wallpaper are among the applications being mimicked.
Reports indicate these sites leverage AI to create a convincing facade, often using outdated Microsoft logos and generic, inaccurate content. Typically built on WordPress, these sites aim to improve their search engine rankings to attract unsuspecting users. Initially, they may direct users to genuine download links, such as those for the Microsoft Store, to build trust.
Once a site garners sufficient traffic and credibility, it begins to subtly replace authentic downloads with malicious software. Some sites employ sophisticated systems, like Amazon CloudFront scripts, to intercept download button clicks. These systems can then redirect visitors to various destinations based on factors like location, browser, or suspected researcher status.
The majority of these over 70 sites are linked to a single owner, initially registered through Epik Inc. before migrating to Dynadot LLC. While the malware distribution is a recent development, several domains have been accumulating search engine rankings for months prior to deploying malicious payloads.