Fake Software Installers Archives

Fake Software Installers Disable Windows Update and Weaken Microsoft Defender

3Sep

By RBNo Comments

News

Fake Software Installers Disable Windows Update and Weaken Microsoft Defender

False software-download websites are being used by an ongoing malware effort to deliver harmful installers and pose as reliable vendors. According to Microsoft, the effort has targeted users who want to download popular software and has led to compromises in a number of industries and organizations, mostly affecting Chinese-speaking users and international corporations' activities in China. Once activated, the installers spread malware that can communicate with infrastructure under attacker control, undermine security measures, and establish persistence. Victims of the activity have come from a variety of industries, including healthcare, manufacturing, gaming, technology, logistics, government, and education. The Windows manufacturer has determined with a considerable degree of ...

TamperedChef Malware Spreads via Fake Software Installers in Ongoing Global Campaign

As part of a global malvertising campaign known as TamperedChef, threat actors are using phony installers that pose as well-known software to fool users into installing malware. According to a recent analysis from the Acronis Threat Research Unit (TRU), the attacks' ultimate objective is to create persistence and distribute JavaScript malware that enables remote access and control. According to the Singapore-based corporation, the campaign is still in progress, with fresh artifacts being found and related infrastructure continuing to function. According to academics Darrel Virtusio and Jozsef Gegeny, the operator or operators rely on social engineering by employing common application names, malvertising, Search Engine Optimization (SEO), and exploited digital certificates in an effo...

PNGPlug Loader Delivers ValleyRAT Malware Through Fake Software Installers

Researchers studying cybersecurity are drawing attention to a number of cyberattacks that have used the well-known malware ValleyRAT to target Chinese-speaking areas such as Hong Kong, Taiwan, and Mainland China. In a technical study released last week, Intezer stated that the attacks use a multi-stage loader called PNGPlug to deliver the ValleyRAT payload. The first step in the infection chain is a phishing page, which is intended to trick victims into downloading a malicious Microsoft Installer (MSI) package that looks like genuine software. When the installer is run, it secretly extracts an encrypted file that contains the malware payload while simultaneously launching a harmless application to allay suspicions read more about PNGPlug Loader Delivers ValleyRAT Malware Through ...