Typosquatted update pages: are your controls keeping up?

TL;DR: A Malwarebytes-documented campaign, according to Sprocket Security, uses a fake Microsoft support page, a believable Windows update lure, and a packaged MSI that steals browser passwords and Discord tokens while major antivirus engines record zero detections. The pattern shows that polished impersonation and layered payload delivery still outrun signature-based controls.

NHIMG editorial — based on content published by Sprocket Security: This fake Windows support website delivers password-stealing malware

By the numbers:

• The malicious installer was 83 MB, which helped it resemble a legitimate system update package.
• The campaign used a French-language fake update page and a believable Windows 24H2 KB article number to increase trust.

Questions worth separating out

Q: How should security teams stop fake software update pages from succeeding?

A: Combine domain monitoring, web filtering, and user guidance that specifically covers software-update delivery channels.

Q: Why do stolen browser passwords remain dangerous after MFA is enabled?

A: Because MFA protects the interactive login step, but stolen browser credentials and session tokens can still enable account takeover if the attacker also captures a valid session or recovery path.

Q: What do security teams get wrong about antivirus in credential-stealing campaigns?

A: They treat antivirus as a final control rather than one signal among several.

Practitioner guidance

• Block lookalike software-update domains Monitor for typosquatted domains that impersonate your software vendors and sinkhole or block them before users can reach a fake update flow.
• Treat browser credentials as governed secrets Reduce reliance on stored passwords where possible, and add controls for browser-stored secrets, session tokens, and app-authentication artifacts.
• Layer detection beyond antivirus Use DNS filtering, secure web gateways, and behaviour-based endpoint monitoring to catch malicious downloads and post-execution tampering.

What's in the full analysis

Sprocket Security's full analysis covers the operational detail this post intentionally leaves for the source:

• The exact lure construction and file structure used to make the fake update page and MSI look legitimate.
• The payload behaviour that separates browser credential theft from Discord token interception and app tampering.
• The detection gaps researchers observed across major antivirus engines and why the files evaded signature-based controls.
• The campaign indicators and artefacts teams can use to tune endpoint, DNS, and web-filtering detection logic.

👉 Read Sprocket Security's analysis of the fake Windows support page malware campaign →

Typosquatted update pages: are your controls keeping up?

Explore further

View Full Forum →  |  NHI Foundation Course →