A deceptive website has emerged, closely mimicking the homepage of CNN, enticing visitors to download what it claims is “the new CNN app.” However, this app is not affiliated with CNN in any way. This campaign extends beyond CNN, targeting users with counterfeit installers for well-known software such as Stremio and Avast, all aimed at Windows users. The installers are part of a broader scheme designed to mislead individuals into installing legitimate remote-management software that is linked to the attackers’ accounts.
Victims, rather than receiving the software they anticipated, inadvertently install O&O Syspectr, a genuine and digitally signed remote administration tool used by IT professionals. In the hands of malicious actors, this tool can grant remote access to a victim’s computer, enabling them to execute commands, install additional software, or sift through files and data. All the deceptive lures—CNN, Avast, and Stremio—trace back to the same Syspectr account.
Another fraudulent site promotes a fake crypto-mining browser game, yet delivers the same software from a different Syspectr account.
What the fake CNN page looks like
The counterfeit CNN site is designed with such precision that it could easily fool the casual observer. It features current headlines, mimics the layout of the actual site, and even includes a red “Live Updates” tag on a genuine story. Almost immediately, a pop-up appears, urging visitors to “Get the latest news first in the new CNN app—it’s live and free,” accompanied by a conspicuous red Download button.
The file linked to this button is named CNN_App.setupad4693fd-d903-4791-8f58-975261c93ca2.exe, which is, in fact, the same Syspectr installer that appears under various branding across different sites, complete with the account ID embedded in the filename.
The same trick, impersonating other brands
Another fraudulent site, avast-premium[.]shop, closely imitates Avast’s legitimate download page, complete with the logo, review scores, and a blue “Free download” button for “Avast One.” The file behind this button is named AVAST_App.setup4693fd-d903-4791-8f58-975261c93ca2.exe.
Similarly, a malicious site at stremiotv[.]online replicates Stremio, a legitimate media center application, directing users to download Stremio_App.setup4693fd-d903-4791-8f58-975261c93ca2.exe.
Both of these sites carry the same account ID found in the CNN installer. By impersonating trusted brands, the attackers successfully trick users into installing the legitimate O&O Syspectr remote-access tool, granting them unauthorized access to the victims’ computers.
A different kind of bait
Not every lure relies on a trusted brand. The site syncminer[.]xyz creates its own bait: an “idle miner” browser game displaying a slowly increasing cryptocurrency balance, with a “Download Miner Plugin” button promising quicker payouts. An identical site, idleminer[.]pro, features the same layout, game, and download link.
Both sites distribute the same file, named oo-syspectr-setup9158bf2a-ff25-4290-b96c-2dc5eb310391.exe, which carries its own unique account ID, distinct from those associated with the CNN, Avast, and Stremio lures.
It’s not malware, which is why antivirus can miss it
Each of these files is a legitimate, digitally signed piece of software from O&O Software GmbH, a reputable German company. Syspectr is marketed openly to IT departments, providing operators with remote desktop control and an admin-level command line on any machine where it is installed.
This is precisely why antivirus software may not flag it. Antivirus programs are designed to detect malicious software, not to identify a legitimately signed business tool simply based on its method of installation. The attackers only need to persuade victims to install a legitimate remote-management tool already linked to their accounts.
The 10-second check that gives it away
For Windows users, a quick check can reveal the true nature of any installer. By right-clicking the installer, selecting Properties, and navigating to the Details tab, users can view two critical fields: File description and Product name. Every installer examined identifies itself as O&O Syspectr, accompanied by a copyright notice for O&O Software GmbH.
While the filename can be altered by anyone distributing the file, these embedded details originate from the signed software itself. Altering them would invalidate the digital signature, thus providing clarity on the true nature of the installer.
How we know these are connected
Each Syspectr installer contains the account ID of the individual who generated it, embedded directly in the filename. The files branded as CNN, Avast, and Stremio all share the exact same account ID, indicating they were created from a single Syspectr account and merely reskinned for various lures.
The Syspectr installer distributed through the fraudulent crypto-mining game carries a different account ID, suggesting either a second operator employing the same tactics or the same group operating under an alternate account.
O&O Software response
In response to this alarming situation, O&O acted swiftly. Within days, the company disabled Remote Desktop and Remote Console access for free Syspectr accounts, limiting these features to paid plans only.
O&O has since identified and suspended the abusive accounts, preventing them from adding new devices. Their analysis revealed that the attackers relied solely on Remote Console, not Remote Desktop. The company has committed to ongoing monitoring for this pattern and will tighten restrictions further if necessary.
How to protect yourself
- Only download software from the vendor’s official website. Search results and ads may lead to convincing fakes.
- Before executing any unfamiliar installer, right-click it on Windows, navigate to Properties > Details, and verify the File description and Product name fields.
- If you discover O&O Syspectr installed without your consent, uninstall it via Settings > Apps and conduct a full antivirus scan.
- If you have recently run an installer like this, change passwords for any accounts accessed on that machine from a secure device.
- Enhance your online browsing safety. Malwarebytes Browser Guard can block known scam and lookalike pages before you visit them.
Remember
Fake download sites do not always deliver malware. Sometimes, they distribute legitimate software that has been weaponized by the distributor. Therefore, it is crucial to download software from the authentic vendor and, if something seems amiss, verify the installer’s true nature before proceeding.
Indicators of Compromise (IOCs)
Account ID 4693fd-d903-4791-8f58-975261c93ca2:
app.cnn-news[.]net→CNN_App.setupad4693fd-d903-4791-8f58-975261c93ca2.exeavast-premium[.]shop→AVAST_App.setup4693fd-d903-4791-8f58-975261c93ca2.exestremiotv[.]online→Stremio_App.setup4693fd-d903-4791-8f58-975261c93ca2.exe
Account ID 9158bf2a-ff25-4290-b96c-2dc5eb310391:
syncminer[.]xyz→oo-syspectr-setup9158bf2a-ff25-4290-b96c-2dc5eb310391.exeidleminer[.]pro→oo-syspectr-setup9158bf2a-ff25-4290-b96c-2dc5eb310391.exe
Stop threats before they can do any harm.
Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →
