Fake Windows update installs hidden malware

Fake Windows update spreads stealth malware that steals logins and data. Learn how it works and how to protect yourself.

Science/Technology Apr 20, 2026 0 0 Add to Reading List

At a glance

A fake Microsoft update site is tricking users into downloading malware disguised as a legitimate Windows installer.
The attack uses trusted tools and hidden scripts to avoid detection by many antivirus programs.
Once installed, the malware can steal passwords, payment details and account access from your device.
The safest way to update Windows is through your system settings, not by downloading files from websites.

If you’ve ever clicked “Check for updates” and trusted what you saw, you’re not alone. That’s exactly what this latest scam is counting on.

The page mimics official branding, includes a believable knowledge base number and presents a big blue download button that feels familiar.

The catch? The download installs malware designed to steal passwords, payment details and account access.

According to researchers at Malwarebytes Labs, a cybersecurity research and threat intelligence team inside Malwarebytes, the site uses a typosquatted domain that looks close enough to a real Microsoft URL to fool a quick glance. That small trick is often all it takes.

A fake Windows update can look completely legitimate, blending into everyday activity on your device without raising suspicion.

Why this fake Windows update malware slips past detection

At first glance, nothing seems off. The file looks like a standard Windows installer. It even lists “Microsoft” in its properties. That’s where this attack gets clever. Instead of using obvious malicious code, the attackers built the installer with legitimate tools and layered the attack in stages. Each piece looks harmless on its own.

Here’s what’s happening behind the scenes:

The installer launches what appears to be a normal app
That app quietly runs hidden scripts
A disguised process loads a full Python environment
Data theft tools activate in the background

Because each step looks routine, many security tools fail to flag it right away. Researchers also noted that antivirus engines initially showed zero detections for key parts of the attack. That does not mean the file is safe. It means the malicious behavior is well hidden.

The phishing page mimics Microsoft’s design and uses a convincing URL, making it easy to trust at a quick glance.

Credit: Malwarebytes Labs

What this fake Windows update malware is stealing

Once installed, the malware gets to work fast. It collects details about the infected device, including location and IP address. Then it reaches out to remote servers to receive instructions and upload stolen data.

The targets include:

Saved browser passwords
Login sessions and cookies
Payment details
Discord account tokens

It even tries to shut down other processes on your system to avoid interference while it works. In some cases, it modifies apps like Discord to intercept account activity in real time.

How the fake Windows update malware stays on your system

This malware is designed to stick around. It creates entries that look like normal system processes, so they blend in. One registry entry mimics Windows Security Health, which most users would ignore. It also drops a shortcut in your startup folder with a familiar name like Spotify. That makes it easy to overlook. Two different persistence tricks mean it can survive a reboot and keep running.

Why this fake Windows update scam feels so real

There’s a bigger trend behind this. Researchers say campaigns like this often target regions where large data breaches have already exposed personal information. When attackers already know your name, provider or habits, they can build scams that feel tailored to you. That makes a fake Windows update page far more believable than a generic phishing email.

It also highlights something important. Today’s malware often hides inside legitimate tools and trusted frameworks. That makes it harder to detect and easier to trust. This campaign shows how far scammers have come. They are no longer relying on sloppy emails or obvious fake links. Instead, they are building layered attacks that look and behave like trusted software.

Even experienced users can get caught off guard when everything appears normal. The biggest takeaway is simple. A clean scan result or a familiar interface does not guarantee safety.

Even the downloaded file appears authentic, with spoofed Microsoft details that help the malware slip past users and security tools.

Credit: Malwarebytes Labs

Microsoft says it’s aware of the threat

Microsoft confirmed it is tracking this type of activity and urges users to be cautious when downloading updates from unfamiliar sources. A Microsoft spokesperson tells CyberGuy,

“We are aware of reports of fraudulent websites impersonating Microsoft, and we actively work to detect and disrupt malicious activity across the internet. We encourage customers to be cautious of unexpected prompts or downloads and to verify that they are interacting with legitimate Microsoft domains. As a best practice, we recommend users verify the legitimacy of a link by going directly to our website from your own saved favorite, from a web search, or by typing the domain name yourself.”

For more guidance on how to protect against online phishing scams, you can refer to Microsoft’s official support page.

Ways to stay safe from fake Windows update malware

You don’t need to be a security expert to avoid this. A few habits make a big difference.

1) Only update Windows from your settings

Go to Settings > Windows Update and check for updates there. Avoid downloading updates from websites.

2) Double-check the URL

Real Microsoft pages use microsoft.com. Anything else, even if it looks close, should raise a red flag.

3) Be cautious with urgent update prompts

If a site or message pressures you to install an update, stop and verify it manually.

4) Use strong antivirus software with behavior detection

Traditional antivirus software, which often comes built into your device or as basic security software, mainly looks for known threats using signature matching, which means it can miss new or well-hidden attacks like this one. Strong antivirus software like TotalAV uses behavior detection to monitor what programs are doing in real time, helping flag suspicious activity even if the malware hasn’t been seen before. Our #1 pick for antivirus is TotalAV ($19 for 5 licenses). Read more here.

5) Use a data removal service to limit your exposure

If your personal information is already circulating online from past breaches, it can make scams like this more convincing. A data removal service such as Incogni helps reduce how much of your information is publicly available, making it harder for attackers to target you with tailored phishing attempts.

Is your personal information exposed online?

Run a free scan to see if your personal info is compromised. Results arrive by email in about an hour.

6) Turn on two-factor authentication

Two-factor authentication (2FA) adds a second layer of protection if your passwords are stolen.

7) Avoid downloading installer files from unknown sites

Legitimate updates rarely require manual downloads.

Related Links:

Kurt’s key takeaways

Fake updates are one of the most effective tricks because they tap into something we all trust. Keeping your system secure should not put you at risk, yet that’s exactly what attackers are exploiting here. The safest move is to slow down, verify where updates come from and stick to built-in tools whenever possible.

Are tech companies doing enough to keep fake updates from putting your data at risk? Let us know your thoughts in the comments below.

FOR MORE OF MY TECH TIPS & SECURITY ALERTS, SUBSCRIBE TO MY FREE CYBERGUY REPORT NEWSLETTER HERE

Read Original