Notifications
Clear all
Topic starter
18/08/2026 2:46 pm
TL;DR: A Malwarebytes-documented campaign, according to Sprocket Security, uses a fake Microsoft support page, a believable Windows update lure, and a packaged MSI that steals browser passwords and Discord tokens while major antivirus engines record zero detections. The pattern shows that polished impersonation and layered payload delivery still outrun signature-based controls.
NHIMG editorial — based on content published by Sprocket Security: This fake Windows support website delivers password-stealing malware
By the numbers:
- The malicious installer was 83 MB, which helped it resemble a legitimate system update package.
- The campaign used a French-language fake update page and a believable Windows 24H2 KB article number to increase trust.
Questions worth separating out
Q: How should security teams stop fake software update pages from succeeding?
A: Combine domain monitoring, web filtering, and user guidance that specifically covers software-update delivery channels.
Q: Why do stolen browser passwords remain dangerous after MFA is enabled?
A: Because MFA protects the interactive login step, but stolen browser credentials and session tokens can still enable account takeover if the attacker also captures a valid session or recovery path.
Q: What do security teams get wrong about antivirus in credential-stealing campaigns?
A: They treat antivirus as a final control rather than one signal among several.
Practitioner guidance
- Block lookalike software-update domains Monitor for typosquatted domains that impersonate your software vendors and sinkhole or block them before users can reach a fake update flow.
- Treat browser credentials as governed secrets Reduce reliance on stored passwords where possible, and add controls for browser-stored secrets, session tokens, and app-authentication artifacts.
- Layer detection beyond antivirus Use DNS filtering, secure web gateways, and behaviour-based endpoint monitoring to catch malicious downloads and post-execution tampering.
What's in the full analysis
Sprocket Security's full analysis covers the operational detail this post intentionally leaves for the source:
- The exact lure construction and file structure used to make the fake update page and MSI look legitimate.
- The payload behaviour that separates browser credential theft from Discord token interception and app tampering.
- The detection gaps researchers observed across major antivirus engines and why the files evaded signature-based controls.
- The campaign indicators and artefacts teams can use to tune endpoint, DNS, and web-filtering detection logic.
👉 Read Sprocket Security's analysis of the fake Windows support page malware campaign →
Typosquatted update pages: are your controls keeping up?
Explore further
18/08/2026 3:29 pm
Brand trust has become an access control problem. This campaign succeeds because the user’s first verification step is visual, not cryptographic. Once a fake update page convincingly mirrors a legitimate support experience, the attacker inherits the trust relationship that should have belonged to the software publisher or update channel. IAM teams should treat software-delivery trust as part of identity governance, not only as a user-awareness issue.
A question worth separating out:
Q: Who is accountable when a user installs malware from a fake update page?
A: Accountability is shared across security, endpoint, and identity teams because the failure spans brand trust, download governance, and account protection. The right response is to review trusted-software distribution, privileged account protections, and recovery controls so stolen secrets do not translate into durable access.
👉 Read our full editorial: Typosquatted update pages are still bypassing user trust
