These fake download websites look real and rank high on Google, until they swap the links for malware
TL;DR AI
2 min readKey summary
Security researchers uncovered a network of fake download sites that copied popular Windows app pages and ranked well in search.
After attracting traffic, the sites switched from legitimate installers to malicious downloads.
The operation impersonated Wintoys, PowerToys, CrystalDiskMark, EasyBCD, Lively Wallpaper, Ghidra, dnSpy, and SpiderFoot.
A traffic distribution system routed visitors to either legitimate resources or malware, including an infostealer, a clipboard crypto stealer, and an unwanted-software loader.
More than 5,000 VirusTotal submissions were tied to the samples, underscoring the risk of search engine poisoning and credential, privacy, and crypto theft.