BENGALURU, April 19, 2026 — Cybersecurity researchers have uncovered a sophisticated new campaign where hackers are using highly convincing, fake Windows support pages to trick users into downloading “critical updates” that actually deliver potent data-stealing malware.
The campaign, primarily spotted this month, targets users with localized phishing pages—including a major wave specifically targeting French-speaking users—designed to look identical to official Microsoft Support sites.
The Bait: Windows 11 Version 24H2
The attackers are leveraging the recent buzz around the Windows 11 24H2 cumulative update. Victims are lured to typosquatted domains, such as microsoft-update[.]support, which feature official branding, plausible KB (Knowledge Base) article numbers, and a large blue “Download” button.
Unlike typical low-effort scams, this operation uses advanced techniques to bypass detection:
-
Spoofed Metadata: The downloaded file, often named
WindowsUpdate 1.0.0.msi, has its file properties modified to show “Microsoft” as the author. -
Legitimate Frameworks: The malware is built using the WiX Toolset, a legitimate open-source installer framework, which helps it appear as a standard system package to many antivirus tools.
-
Hybrid Payloads: Once installed, the malware uses a “wrapper” of Electron and Python to extract sensitive information, including browser-stored passwords, session cookies, and Discord tokens.
Persistence and Evasion
The malware is designed to survive a system reboot. Researchers found that it creates a registry key named “SecurityHealth” to launch itself automatically. In a clever attempt at camouflage, it also places a shortcut named “Spotify.lnk” in the user’s Startup folder; while it looks like the popular music app, it actually points to the malicious executable.
Once active, the “stealer” sends the harvested data to attacker-controlled servers and public file-sharing services like Gofile.
How to Stay Safe
Experts emphasize that Microsoft never distributes Windows updates via standalone downloads from support websites. To protect yourself:
-
Use Official Channels: Always go to Settings > Windows Update to check for and install updates.
-
Verify the URL: Legitimate Microsoft updates are only served from domains ending in
.microsoft.com. Be wary of suffixes like.support,.online, or.biz. -
Check Your Registry: If you suspect an infection, check the
Runkey in your Windows Registry for suspicious entries pointing to yourAppDatafolder. -
Reset Credentials: If you have interacted with one of these sites, assume your browser-saved passwords and session cookies are compromised. Enable Two-Factor Authentication (2FA) on all sensitive accounts immediately.
This latest threat serves as a reminder that as software updates become more frequent, so do the opportunities for threat actors to hide behind the veil of “security maintenance.”
