A fake Microsoft support website is tricking individuals into downloading what appears like a traditional Windows replace. Instead, it installs malware designed to steal passwords, fee particulars, and account entry. Because the file appears reliable and avoids detection, it may possibly slip previous each customers and safety instruments.
A really convincing Windows replace
We noticed the marketing campaign at microsoft-update[.]support, a typosquatted area dressed as much as appear to be an official Microsoft support web page. The web site is written solely in French (however these campaigns are inclined to unfold shortly) and presents a fake cumulative replace for Windows model 24H2, full with a believable KB article quantity. A big blue obtain button invitations customers to put in the replace.
What will get downloaded is WindowsUpdate 1.0.0.msi, an 83 MB Windows Installer package deal. At first look, every thing appears reliable. Its file properties are fastidiously spoofed: the Author subject reads “Microsoft,” the title reads “Installation Database,” and the Comments subject claims it incorporates “the logic and data required to install WindowsUpdate.”
The package deal was constructed with WiX Toolset 4.0.0.5512, a reliable open-source installer framework, and was created on April 4, 2026.
Why this marketing campaign is focusing on France
The alternative to focus on French-speaking customers just isn’t random. France has suffered a historic cascade of knowledge breaches over the previous two years, leaving a staggering quantity of non-public data circulating on prison marketplaces. The breaches present the uncooked knowledge, and campaigns like this one flip that into extremely plausible scams.
In October 2024, Free, France’s second-largest web service supplier, confirmed that an attacker had accessed personal data for roughly 19 million subscriber contracts, together with checking account particulars. Just weeks earlier, Société Française du Radiotéléphone (SFR) disclosed its own breach exposing buyer names, addresses, telephone numbers, and banking particulars.
Earlier in 2024, France Travail, the nationwide public employment service, suffered an intrusion that compromised the data of 43 million people, overlaying present and previous jobseekers spanning twenty years. Researchers additionally discovered an unprotected Elasticsearch server aggregating 90 million data from not less than 17 separate French breaches right into a single database.
This torrent of leaked knowledge has made France a sexy goal for credential theft. KELA’s 2025 infostealer research recognized France among the many prime international locations for victims, alongside Brazil, India, the US, Spain, the United Kingdom, and Indonesia.
When attackers have already got a sufferer’s title, deal with, and ISP from a earlier leak, a French-language “Windows update” web page turns into a much more convincing lure than a generic English one.
Electron on the skin, Python on the within
When the MSI executes, it installs an Electron utility (primarily a stripped-down Chromium browser bundled with customized JavaScript) to C:Users.
The important binary, WindowsUpdate.exe, is a renamed copy of the usual Electron shell—VirusTotal’s metadata identifies it as electron.exe. Across 69 antivirus engines, it drew zero detections as a result of the executable itself is clear. This suggests the malicious logic lives contained in the Electron app’s bundled JavaScript (usually packaged as app.asar).
Alongside the Electron shell sits AppLauncher.vbs, a Visual Basic Script that acts because the preliminary launcher. The system’s built-in cscript.exe interpreter runs the VBS, which then begins the Electron app—a basic living-off-the-land method that avoids launching the payload straight and retains the execution chain trying routine in course of logs.
But the Electron wrapper is barely the outer layer. Once operating, WindowsUpdate.exe spawns _winhost.exe, a renamed Python 3.10 interpreter disguised to resemble a reliable Windows course of. This course of unpacks a full Python runtime intoC:Users, together with python.exe and supporting libraries.
It then installs a set of Python packages generally seen in knowledge theft instruments:
- pycryptodome, used to encrypt stolen knowledge
- psutil, used to examine operating processes and detect sandbox environments
- pywin32, which permits deep entry to the Windows API
- PythonForWindows, used to work together with system internals reminiscent of processes and privileges
Analysis of the Electron app’s JavaScript confirms this. Two closely obfuscated recordsdata, processed utilizing strategies like control-flow flattening and opaque predicates, include the core performance.
The bigger file (~7 MB) is the principle stealer payload, with references to pbkdf2, sha256, and AES decryption routines, in addition to a marketing campaign expiry verify. The smaller file (~1 MB) targets Discord: as a result of Discord runs on Electron, the script modifies its code to intercept login tokens, fee particulars, and two-factor authentication adjustments when the app is opened.
Both recordsdata returned zero detections throughout main antivirus engines—the results of malware that hides inside reliable software program and closely obfuscated code.
Two methods it survives a reboot
The malware units up two impartial persistence mechanisms.
First, reg.exe writes a worth known as SecurityHealth below the consumer’s CurrentVersionRun registry key, pointing to WindowsUpdate.exe. The worth title impersonates Windows Security Health, the service chargeable for Defender notifications. It’s one thing most customers and even IT employees would scroll previous with out suspicion.
Second, cscript.exe drops a shortcut file named Spotify.lnk into the consumer’s Startup folder. Anyone who notices it could probably assume Spotify had configured itself to launch at login.
Two persistence mechanisms, two completely different disguises, every designed to appear to be one thing the consumer would anticipate to see.
Fingerprinting the sufferer, phoning house, importing the haul
Within seconds of launching, WindowsUpdate.exe reaches out to www.myexternalip.com and ip-api.com to find the sufferer’s public IP deal with and geolocation. This sort of reconnaissance is a near-universal trait of infostealers, telling the operator the place the sufferer is and will decide what knowledge will get collected.
The malware then contacts its command-and-control (C2) infrastructure. It reaches datawebsync-lvmv.onrender[.]com, a C2 endpoint hosted on Render, and sync-service.system-telemetry.employees[.]dev, a relay operating on Cloudflare Workers. That second area is especially artful: “system-telemetry” is strictly the sort of subdomain a community analyst would possibly dismiss as reliable monitoring site visitors throughout a fast log overview.
For exfiltration, the malware turns to store8.gofile[.]io, a file-sharing service that enables nameless uploads. Gofile has turn into a favorite amongst commodity stealers as a result of it’s free, ephemeral, and produces no paper path for the operator.
Hundreds of processes killed earlier than breakfast
Sandbox telemetry captured greater than 2 hundred separate invocations of taskkill.exe, every launched as a person course of. While the particular goal processes weren’t recorded within the condensed telemetry, the sheer quantity and sample is in line with infostealers that systematically terminate safety instruments, browser processes (to unlock credential databases), and competing malware earlier than starting their assortment routine. Kill every thing which may intervene, then get to work.
Why the automated defences gave it a go
At the time of research, VirusTotal confirmed zero detections throughout 69 engines for the principle executable and 62 for the VBS launcher. No YARA guidelines matched, and behavioural scoring categorised the exercise as low danger.
This just isn’t a failure of any single software. It’s the supposed results of the malware’s structure.
The Electron shell is a reliable binary utilized by hundreds of thousands of functions. The malicious logic is hidden inside obfuscated JavaScript, which conventional antivirus instruments don’t deeply examine. The Python payload runs below a deceptive course of title and pulls in elements at runtime from what seem like regular sources.
Individually, each bit appears innocent. It’s solely while you comply with the total chain—VBS launcher to Electron app to renamed Python course of to knowledge assortment and exfiltration—that the exercise turns into clearly malicious.
Since our evaluation, we’ve added detections to guard customers from this menace.
What this implies and what to do subsequent
The mixture of a localized phishing lure, a legitimately constructed MSI installer, an Electron wrapper, and a runtime-deployed Python payload reveals how commodity stealers are evolving. Each layer serves a objective: the MSI gives a well-known set up expertise, the Electron shell helps the file seem clear, and the Python runtime provides versatile entry to the working system. The total chain is constructed from off-the-shelf, reliable elements.
The focusing on of French customers follows a transparent sample. When tens of hundreds of thousands of non-public data are already circulating, the price of making a convincing localized lure drops considerably. An attacker who already is aware of which supplier a sufferer makes use of can tailor a phishing web page to match what they anticipate to see, whether or not that’s from their ISP or, on this case, Microsoft.
The most vital takeaway is {that a} zero-detection VirusTotal outcome doesn’t imply a file is protected. It usually means the malicious logic is hidden, e.g. inside obfuscated scripts or delivered at runtime, leaving little for conventional detection strategies to flag.
If you suppose you could have put in this replace, right here’s what to do:
- Check your registry key. To do that, press Windows + R, sort
regedit, and press Enter. Go toHKCUSOFTWAREMicrosoftWindowsCurrentVersionRun. Look for an entry namedSecurityHealthpointing toWindowsUpdate.exein your AppData folder, and delete it. - Look for a
Spotify.lnkfile in your Startup folder that you simply didn’t create, and take away it Delete the folderC:UsersAppDataLocalProgramsWindowsUpdate - Clear the non permanent recordsdata in
C:UsersAppDataLocalTempWinGettools - Change all passwords saved in your browser—assume saved credentials, cookies, and session tokens could have been compromised
- Enable two-factor authentication, prioritizing e-mail and monetary accounts
- Run a full system scan with an up-to-date antimalware tool (ideally one with behavioural detection)
How to replace Windows safely
The most secure method to replace Windows is thru the built-in replace function. Open Start, go to Settings > Windows Update, and click on “Check for updates.” This ought to at all times be your first port of name.
Microsoft does supply standalone replace packages via the Microsoft Update Catalog (catalog.replace.microsoft.com), however that is the one reliable supply for guide downloads. Any different website providing a Windows replace as a file needs to be handled as suspicious.
Be cautious of pages that mimic Microsoft Support or Windows Update. These can look convincing, however the URL is what issues. Legitimate Microsoft pages are solely served from domains ending in microsoft.com. A site like microsoft-update[.]support could look believable, however it’s not linked to Microsoft.
If you obtain an e-mail, textual content, or notification urging you to put in an pressing replace, don’t click on the hyperlink. Instead, open Settings > Windows Update and verify straight.
Finally, take into account enabling automated updates. This removes the necessity to obtain updates manually and reduces the prospect of being tricked into putting in a fake one.
Indicators of Compromise (IOCs)
File Hashes (SHA-256)
13c97012b0df84e6491c1d8c4c5dc85f35ab110d067c05ea503a75488d63be60(WindowsUpdate.exe)c94de13f548ce39911a1c55a5e0f43cddd681deb5a5a9c4de8a0dfe5b082f650(AppLauncher.vbs)
Domains
microsoft-update[.]support(phishing lure)datawebsync-lvmv[.]onrender[.]com(C2)sync-service[.]system-telemetry[.]employees[.]dev(C2 relay)store8[.]gofile[.]io(exfiltration)www[.]myexternalip[.]com(IP reconnaissance)ip-api[.]com(geolocation)
File System Artifacts
C:UsersAppDataLocalProgramsWindowsUpdateWindowsUpdate.exe C:UsersAppDataLocalProgramsWindowsUpdateAppLauncher.vbs C:UsersAppDataRoamingMicrosoftWindowsStart MenuProgramsStartupSpotify.lnk
