Clever Malware Masquerades as Windows 11 Installer
Microsoft announced Windows 11 last year, but deploying the update to existing devices has been a slow process. In fact, Microsoft isn’t even providing the update on PCs that lack certain modern hardware features. Anyone who goes looking for a manual upgrade to Windows 11 might find themselves on the receiving end of a nasty malware attack, according to HP security researchers. A Russian website disguised as an official Microsoft page is distributing an “upgrade installer” that won’t get you Windows 11. What it will get you is a bunch of malware.
The site in question is windows-upgraded[.com], and we strongly suggest you don’t visit it (you probably won’tbe able to as it appears to be decommissioned). While reports suggest you will only encounter misfortune if you download files from this site, you don’t want to take any chances with these online criminals. The site is a dead ringer for Microsoft’s Windows Update site, and even the URL is a pretty good match—the hackers spent big on the .com domain.
Unlike the official website, the upgrade button downloads a ZIP archive hosted on Discord’s servers. This is something of an ongoing problem for the chat app, which has been used to distribute a surprising volume of malware in the past. When downloaded, the archive is just a few megabytes, consisting of an executable and several DLL files. The compressed archive hides the malware’s presence, and something strange happens when the user attempts to extract the files. The file size jumps to 735MB, most of which comes from the .EXE file. HP says the files are padded with 0x30 bytes of data that doesn’t have any bearing on the functionality. It’s just a trick to avoid detection by anti-malware tools, which are often incapable of automatically processing such a large file.
Absent any alarm bells, users will try to open the “upgrade” launcher, infecting their device with the RedLine Stealer malware. This piece of software is dangerous, but it’s not unique—online criminals can buy a copy of RedLine on hacking forums for $100-150. RedLine scrapes information from browsers, including form fill data, saved passwords, and credit card info. It can even steal any cryptocurrency stored on the device or in connected wallets. The researchers draw parallels between this attack and a December 2021 campaign that used a similar fake page that offered downloads of Discord’s desktop client. Instead, users got this same RedLine malware.
If you’re anxious to get Windows 11, make sure to only use the official Microsoft domain or the Windows settings menu. Downloading a random EXE from the internet continues to be a terrible idea.
Continue reading
Google Will Officially Support Installing Chrome OS on Your Old Computer
Google has just acquired Neverware, and its CloudReady product is becoming an official Chrome OS offering.
How to Download and Install Windows 8.1 for Free (Updated)
If you still need Windows 8.1, follow one of the methods listed here to download it today for free.
How to Install Windows 10 in a Virtual Machine
If you have to deal with files you can't trust, need to test multiple OS installations on the same system, or otherwise need access to the OS without wanting to use it as a daily driver, here's how to install Windows 10 in a virtual machine.
Microsoft Will Let Old Systems Install Windows 11, Just Not Automatically
Officially, Microsoft is only making a few changes to its supported CPU list. Unofficially, it looks like it'll be possible to run Windows 11 on old hardware.