Malware Campaign Targets Windows Devices with Trusted Software Impersonation

A sophisticated malware campaign has been identified, targeting Windows devices by impersonating trusted software brands such as Microsoft Edge, Kaspersky, and Razer. The attackers create high-fidelity fraudulent websites that mimic legitimate vendors, luring victims with 'download now' controls to retrieve installer archives.

The operation's infrastructure, payload delivery model, and defense-evasion techniques demonstrate a mature and persistent threat. Microsoft has observed that the campaign primarily affects China-based operations of multinational organizations. The attackers use server-side payload regeneration, changing the file's contents and cryptographic hash with each download, making it difficult to detect through simple hash-based blocking.

The malware chain typically involves downloading an archive, extracting it using tools like 7-Zip or WinRAR, and then launching a stage-one executable. The attackers also use trusted Windows utilities, such as msiexec.exe, to write the payload into C:\\\\Users\\Public. Later-stage files masquerade as legitimate software, including a Philips Speech Driver Client Configuration binary and an Indigo Rose TrueUpdate Client.

Persistence is established through scheduled tasks with unusual names, which repeatedly launch payloads from C:\ProgramData. The malware also creates short-lived SYSTEM-level scheduled tasks to add Microsoft Defender exclusions before deleting them to reduce forensic evidence.