Hackers are quietly building lookalike websites that pretend to be popular Windows apps, then use those pages to push malware onto unsuspecting users.
The scheme already covers more than 70 well known utilities that people trust and download every day. What begins as a helpful looking download page can later turn into a trap once traffic builds and attackers swap in harmful files.
The fake sites copy app names, old logos, and friendly guides so they rank in search results and feel official. Many point visitors toward real store links at first, which lowers suspicion while the pages gather visitors.
Wintoys Developer Bogdan_X identified or noted the malware after spotting a clone of his own app while checking recent search results for feedback and user issues.
Bogdan_X said in a report shared with Cyber Security News (CSN) that a single anonymized contact email tied dozens of these domains together.
The same pattern has already led to real infections for other Windows tools through separate but similar sites. Users who land on the wrong page risk remote access tools, unwanted bandwidth software, and lasting system compromise.
Attackers register domains that closely match names such as PowerToys, WinUtil, EasyBCD, CrystalDiskMark, and Wintoys, then fill the pages with generic blog style content.
The sites often run on common platforms and carry small disclaimers claiming they are independent guides, even while they reuse branding that belongs to the real projects. Search engines can still surface these pages near the top for popular app queries.
A related campaign described by security researchers follows a clear three step path. First the operators harvest traffic with brand style terms. Next they act harmless and offer the downloads people already want.
After enough visits arrive, they replace trusted download links with malware. Check Point findings on similar infrastructure showed traffic direction scripts appearing later, with abuse ramping up from early 2026.
At least two Windows apps outside this exact domain set have already seen live attacks. One Lively Wallpaper impersonation served a trojanized installer that dropped a persistent ScreenConnect remote access service along with bandwidth sharing software.
SignalRGB maintainers also warned about signalrgb.io handing out malware to their community. Those cases show how weaponized remote access tools fit neatly into the same playbook once trust is won.
When Bogdan_X reported the cluster, the first registrar pushed the operator to move the portfolio. Within weeks the full set of domains shifted to a new registrar, keeping the sites alive.
Hosting often sits behind large proxy networks, which adds delay before content comes down. Unfinished clone pages still appear, a sign more apps could be next.
Everyday caution still blocks most of this threat. Download installers only from official project pages, vendor stores, or known GitHub releases, and treat third party mirrors with care even when they look polished.
If you rely on any app in the impersonated set, tell the developer so they can warn users and pursue takedowns.
Report abuse to the domain registrar and the hosting provider, and flag bad search results so fewer people click through. Community blocklists have already started adding many of these names, which helps people who use modern DNS filters.
Similar waves of fake security product sites prove that brand misuse remains a favorite path for malware crews.
Stay alert for slight spelling changes in domain names and for pages that reuse old logos without clear ownership. Official stores and signed packages remain the safest route for Windows utilities.
Sharing clear warnings inside user communities cuts the window attackers need, much like past cases involving counterfeit productivity app downloads that tricked curious users.
Cheap domains and recycled templates can threaten dozens of trusted tools at once. Developers who watch search results for their app names can catch clones early. Users who verify the real source keep their PCs safer without needing deep technical skill.
Indicators of compromise (IoCs):-
| Type | Indicator | Description |
|---|---|---|
| 43345@anonymize.com | Anonymized WHOIS contact email linked to 72 impersonation domains | |
| Domain | wintoys.app | Fake site impersonating Wintoys |
| Domain | powertoys.app | Fake site impersonating PowerToys |
| Domain | power-toys.com | Fake site impersonating PowerToys |
| Domain | winutil.app | Fake site impersonating WinUtil |
| Domain | easybcd.app | Fake site impersonating EasyBCD |
| Domain | crystaldiskmark.net | Fake site impersonating CrystalDiskMark |
| Domain | crystaldiskinfo.app | Fake site impersonating CrystalDiskInfo |
| Domain | christitustool.com | Fake site impersonating Chris Titus Tool |
| Domain | freefilesync.net | Fake site impersonating FreeFileSync |
| Domain | shellmenuview.com | Fake site impersonating ShellMenuView |
| Domain | winexp.app | Fake site impersonating WinExp |
| Domain | zhpcleaner.com | Fake site impersonating ZHPCleaner |
| Domain | cursorslibrary.com | Fake site related to cursor utilities |
| Domain | fakeflashtest.com | Fake site impersonating FakeFlashTest |
| Domain | searchmyfiles.com | Fake site impersonating SearchMyFiles |
| Domain | themouseclicker.com | Fake site impersonating mouse clicker tools |
| Domain | quickassistapp.com | Fake site impersonating Quick Assist |
| Domain | move-mouse.com | Fake site impersonating Move Mouse |
| Domain | movemouse.net | Fake site impersonating Move Mouse |
| Domain | nircmd.net | Fake site impersonating NirCmd |
| Domain | freewheelofnames.com | Fake site impersonating wheel of names tools |
| Domain | productkeyscanner.com | Fake site impersonating product key scanners |
| Domain | chatmate.info | Domain linked to the same WHOIS contact |
| Domain | usblogview.com | Fake site impersonating USBLogView |
| Domain | mouse-mover.com | Fake site impersonating mouse mover tools |
| Domain | mouse-cursors.com | Fake site impersonating mouse cursor tools |
| Domain | mouse-clicker.com | Fake site impersonating mouse clicker tools |
| Domain | mimalloc.com | Domain linked to the same WHOIS contact |
| Domain | mumuplayer.app | Fake site impersonating MuMu Player |
| Domain | wushowhide.com | Fake site impersonating WuShowHide |
| Domain | guiformat.app | Fake site impersonating GuiFormat |
| Domain | droidkit.pro | Domain linked to the same WHOIS contact |
| Domain | spacesniffer.app | Fake site impersonating SpaceSniffer |
| Domain | simplestickynotes.app | Fake site impersonating Simple Sticky Notes |
| Domain | showmore.app | Domain linked to the same WHOIS contact |
| Domain | mousecape.app | Fake site impersonating Mousecape |
| Domain | mousecape.net | Fake site impersonating Mousecape |
| Domain | hashcat.app | Fake site impersonating Hashcat |
| Domain | dshidmini.app | Fake site impersonating DSHidMini |
| Domain | darktable.app | Fake site impersonating darktable |
| Domain | daijisho.app | Fake site impersonating Daijisho |
| Domain | wiblr.com | Domain linked to the same WHOIS contact |
| Domain | skse64.com | Fake site impersonating SKSE64 |
| Domain | sageattention.com | Domain linked to the same WHOIS contact |
| Domain | rezygisk.com | Domain linked to the same WHOIS contact |
| Domain | pwndbg.com | Domain linked to the same WHOIS contact |
| Domain | ocrmypdf.com | Fake site impersonating OCRmyPDF |
| Domain | notatnikonline.com | Domain linked to the same WHOIS contact |
| Domain | noisium.com | Domain linked to the same WHOIS contact |
| Domain | mongosh.com | Fake site impersonating mongosh |
| Domain | lspconfig.com | Domain linked to the same WHOIS contact |
| Domain | liveclockwithseconds.com | Domain linked to the same WHOIS contact |
| Domain | lax1dude.com | Domain linked to the same WHOIS contact |
| Domain | je2be.com | Domain linked to the same WHOIS contact |
| Domain | iso2god.com | Fake site impersonating ISO2GOD |
| Domain | hifiasm.com | Domain linked to the same WHOIS contact |
| Domain | hddsentinel.com | Fake site impersonating Hard Disk Sentinel |
| Domain | hakchi2.com | Fake site impersonating Hakchi2 |
| Domain | gliden64.com | Fake site impersonating GLideN64 |
| Domain | furfsky.com | Domain linked to the same WHOIS contact |
| Domain | freeminutetimer.com | Domain linked to the same WHOIS contact |
| Domain | findoutdate.com | Domain linked to the same WHOIS contact |
| Domain | bepisdb.com | Domain linked to the same WHOIS contact |
| Domain | beardlib.com | Domain linked to the same WHOIS contact |
| Domain | 10mintimer.com | Domain linked to the same WHOIS contact |
| Domain | pyjwt.com | Domain linked to the same WHOIS contact |
| Domain | moliyachi.com | Domain linked to the same WHOIS contact |
| Domain | arduinodroid.com | Fake site impersonating ArduinoDroid |
| Domain | cxxdroid.com | Fake site impersonating Cxxdroid |
| Domain | kalkulyator.com | Domain linked to the same WHOIS contact |
| Domain | retraitedz.com | Domain linked to the same WHOIS contact |
| Domain | urlaubscountdown.com | Domain linked to the same WHOIS contact |
| Domain | signalrgb.io | Malicious site impersonating SignalRGB and distributing malware |
| Domain | mkvtoolnix.com | Additional impersonation domain noted by community reports |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
ALERT!: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.
CDR is the runtime, real-time half of cloud security: while CSPM tells you what’s misconfigured,…
Your SaaS estate M365, Salesforce, Workday, Slack, hundreds of others is a sprawl of misconfigurations,…
DSPM finds sensitive data you didn’t know you had, classifies it, maps who can reach…
Open-source packages are meant to save developers time. In the GemStuffer campaign, that trust became…
Google has released an important Chrome 153 security update that fixes 42 vulnerabilities across the…
The Cybersecurity and Infrastructure Security Agency (CISA) and the National Institute of Standards and Technology…