This fake Windows support website delivers password-stealing malware

[Gandalf_The_Grey]

Content source

https://www.malwarebytes.com/blog/scams/2026/04/this-fake-windows-support-website-delivers-password-stealing-malware

A fake Microsoft support website is tricking people into downloading what looks like a normal Windows update. Instead, it installs malware designed to steal passwords, payment details, and account access. Because the file looks legitimate and avoids detection, it can slip past both users and security tools.

We spotted the campaign at microsoft-update[.]support, a typosquatted domain dressed up to look like an official Microsoft support page. The site is written entirely in French (but these campaigns tend to spread quickly) and presents a fake cumulative update for Windows version 24H2, complete with a plausible KB article number. A large blue download button invites users to install the update.

This fake Windows support website delivers password-stealing malware

A convincing Microsoft lookalike tricks users into downloading malware that steals passwords, payments, and account access.

www.malwarebytes.com

 

[Sampei.Nihira]

Blocked by NextDNS due to:

1. AI-Driven Threat Detection
2. Block Newly Registered Domains (NRDs)
3. HaGeZi Multi Ultimate

 

[Parkinsond]

Blocked by NextDNS due to:

1. AI-Driven Threat Detection
2. Block Newly Registered Domains (NRDs)
3. HaGeZi Multi Ultimate

View attachment 297075

And by ControlD, K, B, and Norton safeweb.

 

[SeriousHoax]

Also by Cloudflare Zero Trust, Kaspersky and a few others.

Anyway, the site is not active anymore.

 

[Marko :)]

Also by Cloudflare Zero Trust, Kaspersky and a few others.
View attachment 297076
Anyway, the site is not active anymore.

I wanted to see what blocked it for me, whether is it Hagezi's list or Cloudflare category. It was Cloudflare malware category indeed (it has priority over Hagezi Pro++).

 

[TuxTalk]

 

[piquiteco]

 

[Zero Knowledge]

It's amazing TLDs let alone MS let people register such domains. You would think MS would buy and register any potential phishing domains like that. Afraid not