Topic starter
18/08/2026 2:46 pm
TL;DR: A Malwarebytes-documented campaign, Sprocket Security reports, uses a fake Microsoft support page and a believable Windows update lure to deliver an MSI that steals browser passwords and Discord tokens. Software distribution controls need to cover where update files come from, not just what lands on the endpoint.
Editorial analysis by NHI Mgmt Group, based on content published by Sprocket Security: “That "Windows Update" Could Be Stealing Your Passwords”.
Key questions
Q: Why do fake update pages create such high account-takeover risk?
A: They combine social engineering with credential harvesting.
Q: What do security teams get wrong about antivirus protection against download lures?
A: They often treat antivirus as the decision point for whether a file is safe.
Q: What breaks when users trust lookalike software update pages?
A: The trust decision breaks before malware ever runs.
Practitioner guidance
- Enforce software-update provenance controls Require updates to originate from approved operating system channels or managed software distribution tools, not from browser prompts or standalone download pages.
- Block lookalike domains before user resolution Continuously monitor for typosquatted domains that impersonate your brands and block them in DNS, proxy and secure web gateway layers as soon as they are discovered.
- Treat unexpected MSI execution as suspicious Alert on installer launches that do not match sanctioned packaging or software inventory, especially when they arrive after a web download rather than through software management.
Bottom line: Typosquatted update pages succeed by exploiting trust in software delivery, not just weak user judgment.
Glossary terms: Typosquatting, Credential Stealer, Token Hijacking, Software Distribution Provenance
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
18/08/2026 3:29 pm
Typosquatted update pages are a trust-engineering problem, not just a phishing problem. The article shows that the attacker is not relying on message volume or crude deception. Instead, the campaign uses brand mimicry, update semantics and a believable installer to convert ordinary user trust into execution. That raises the bar for control design because the failure begins before malware execution, at the trust decision itself. Practitioners should treat external software download trust as a governance control, not a user-awareness footnote.
A few things that frame the scale:
- The average user manages 70 to 100 passwords, many of them outside centralised identity platforms.
A question worth separating out:
Q: How should security teams reduce the risk of compromised credentials in browser-based access?
A: Security teams should combine browser restrictions, step-up authentication, and mediated credential handling. The goal is to prevent raw secrets from being stored, copied, or replayed in environments the enterprise does not control. If the browser is part of the access path, it must also become part of the policy boundary.
👉 Read our full editorial: Typosquatted update pages are still bypassing user trust