Microsoft has raised alarms over a troubling trend: attackers are breaching enterprise systems through phishing download sites that impersonate popular software brands such as Microsoft Edge, Kaspersky, and Razer. These counterfeit pages distribute trojanized installers, enabling attackers to gain persistent access to networks and systems.
“When executed, these malicious installers deploy malware to maintain persistence, undermine security measures, and communicate with infrastructure controlled by the attackers,” Microsoft security experts wrote in a recent blog post. The scale of this campaign, tracked by Microsoft Defender Experts, has been significant, affecting sectors including healthcare, manufacturing, gaming, technology, logistics, government, and education.
Exploiting Trust with Look-Alike Sites
The initial stage of the attack relies on fraudulent download pages that closely mimic legitimate vendor sites, utilizing look-alike domains often featuring .com.cn and .hl.cn suffixes. These deceptive websites direct unsuspecting users to a centralized backend delivering compromised installer archives. Notably, each downloaded file retains the same filename but its hash is altered with every download, indicating a dynamic server-side payload generation system.
This innovation significantly undermines file-based malware detection, emphasizes cybersecurity researcher Vibhum Dubey, who points out that the filename stability offers attackers a layer of protection. “Even if one file is detected and blocked, the next installer could be different,” he warned.
Multi-Stage Infections and System Manipulation
Once a user executes the installer, the malware initiates a multi-tiered infection process. It often begins with a wrapper that deploys the payload to various random locations on the infected system. Compounding the risk, attackers exploit the Windows Installer service through msiexec.exe, a legitimate Microsoft component, to execute their malicious payloads. This clever tactic complicates detection since defenders must look deeper than the binary itself.
“The challenge is understanding why msiexec.exe executed,” Dubey explained. “The focus shifts to deciphering the origin of the MSI and subsequent actions following its launch.” This technique aligns with a broader trend among attackers who are increasingly blending their operations into regular system activities, making malicious behavior harder to discern.
Persistent Access Through Advanced Evasion Techniques
Upon gaining execution rights, the malware establishes mechanisms for persistence via scheduled tasks that imitate standard system behavior, repeatedly launching payloads. This includes privilege escalation tactics that involve short-lived scheduled tasks running with SYSTEM-level access to modify Microsoft Defender settings.
Microsoft observed a variety of evasion strategies, including creating antivirus exclusions, deleting volume shadow copies, and disabling Windows Update services. Dubey noted this combination is particularly striking: “These actions show the malware considers the defender’s perspective, making it harder to detect, hindering patch efforts, and minimizing chances for recovery.” While the techniques themselves aren't groundbreaking, their integration into a singular attack vector points to increasingly sophisticated tooling among adversaries.
Later-stage payloads are designed to establish command-and-control channels using both dedicated infrastructure and cloud services, including object storage for additional payload staging. In certain instances, attack methods even involve direct user interaction, suggesting a move from purely automated processes to more hands-on approaches once access is gained.
Changing Detection Paradigms for Enterprises
This ongoing campaign underscores significant risks for multinational companies, especially where variations in software procurement and IT practices exist across different regions. “Regional offices, particularly in places like China, may adopt different sourcing and security protocols, creating exploitable gaps for attackers,” Dubey noted.
As the counterfeit sites closely resemble trusted vendors, employees might not recognize the imminent threat when downloading software. “Users may believe they’re interacting with a familiar product and have no reason to doubt the legitimacy of the installer,” he added.
Microsoft advises organizations to pivot their detection strategies toward behavioral indicators instead of solely depending on file-based metrics, as filenames and hashes are intentionally randomized in these attacks. Dubey highlighted the importance of this shift: “A Microsoft-signed file doesn’t guarantee the legitimacy of its process. Evaluating the context and sequence of actions is becoming far more critical than examining the file hash alone.”
