In recent times, the habit of searching for Windows utilities through Google has turned into a serious threat. A vast network of counterfeit websites disguised as popular applications has been discovered, jeopardizing users' personal data. Over 70 domains are known to be impersonating well-known Windows applications such as Microsoft PowerToys, CrystalDiskMark, EasyBCD, Wintoys, Lively Wallpaper, and SignalRGB.
The Rise of Fake Websites
According to reports from Windows Latest, numerous fake sites have been appearing at the top of search engine results, despite having no connection to the actual developers of these applications. Some of these sites even redirect their download buttons to legitimate pages on the Microsoft Store, likely as part of a strategy to build trust before executing harmful actions.
How the Scam Works
This deceptive operation came to light when the developers behind Wintoys discovered an unofficial site called “wintoys.app.” This site used an outdated logo and generic content generated by AI. Further investigation revealed a collection of 72 similar addresses, all registered through the same company.
Security Risks and Malware
Security researchers at Check Point have documented a broader ecosystem employing highly sophisticated tactics. Initially, these imitation sites can link to genuine software, helping them attract visitors and improve their search rankings. JavaScript can then intercept clicks and reroute selected users through a Traffic Distribution System, which alters destinations based on factors like location, browser, VPN usage, and whether the visitor resembles a security researcher.
Some users end up receiving legitimate or unwanted software, while others are exposed to malware such as RemusStealer, which targets browser data, password managers, cryptocurrency wallets, and authentication tools. Check Point found over 100 active sites using related routing scripts and more than 5,000 VirusTotal submissions connected to this campaign.
Identifying and Avoiding Threats
Some cloned applications have already begun spreading malware. For instance, the fake Lively Wallpaper site distributed a hijacked installer containing malicious DLLs, persistent remote access services, and bandwidth-sharing software. Legitimate developers of the application confirmed that the domain had no affiliation with their project.
SignalRGB has also raised alarms about two imitation domains that are prominently appearing in search results. Anyone who downloads installers from these sites is urged to remove them and perform a thorough malware scan.
Best Practices for Safe Downloads
The best way to avoid these threats is to stick to the Microsoft Store or verified developer websites or GitHub pages. Always check the domain before downloading, ensure that the installer has a valid digital signature, and never assume that the top results on Google are the official ones.
The threat of fake websites serves as a reminder of the importance of digital vigilance. As scam tactics become more sophisticated, users must exercise caution with every download. Protecting personal data relies on simple yet crucial habits: verifying the source before clicking the download button.
Source: https://telset.id/how-to/waspada-72-situs-palsu-aplikasi-windows-incar-data-pengguna
