Fake Microsoft Edge, Kaspersky and Razer Installers Used to Compromise Windows Systems

An ongoing malware campaign has emerged, leveraging counterfeit download pages to target well-known software brands such as Microsoft Edge, Kaspersky, and Razer. This operation aims to compromise Windows devices and has affected a diverse range of sectors, including healthcare, manufacturing, gaming, technology, logistics, government, and education. The widespread appeal of these software-download lures underscores the sophistication of the threat landscape.

While Microsoft has not linked this activity to any nation-state actor, the campaign exhibits characteristics of a mature and persistent operation, evident in its infrastructure, payload delivery model, and advanced evasion techniques.

The initial phase of the campaign involves high-fidelity fraudulent websites that closely mimic legitimate vendors. Some observed lure domains include app-microsoft-edge[.]com[.]cn, kaspersky-lab[.]hl[.]cn, and pc-razerzone[.]com[.]cn, alongside look-alikes for other commonly downloaded applications such as Calibre, SteelSeries, and DiskGenius. These sites cleverly replicate branding and prominently feature “Download now” buttons to entice unsuspecting victims into downloading installer archives.

In one instance, Microsoft noted a counterfeit Razer download page redirecting users to gehie246[.]com/712down, which delivered an archive named app_setup.6653004.zip. A notable evasion tactic employed by the attackers is server-side payload regeneration, allowing the archive filename and delivery URL to remain constant while the file’s contents and cryptographic hash change with each download.

Windows Users Targeted

Microsoft’s analysis revealed two distinct copies of the same archive created within a mere 70 seconds of each other. The campaign utilizes commercial hosting and DNS providers with significant unrelated tenancy, suggesting that the ASN and nameserver should be viewed as hunting pivots rather than simple blocklist entries.

This approach complicates straightforward hash-based blocking methods. Instead, defenders are advised to correlate browser download telemetry, particularly FileOriginUrl and FileOriginReferrerUrl, with look-alike domains, recurring archive-name families, and specific delivery paths such as /712down, /73inst, and /7qinst.

Once a victim extracts the ZIP file, a bundled wrapper installer activates a stage-one executable in randomized directories, often located under C:UsersPublic or C:Program Files (x86). Despite variations in filenames and paths, Microsoft observed consistent payload content across multiple executions, facilitating behavior- and hash-based detection.

The attack chain typically unfolds with Microsoft Edge downloading the archive, followed by extraction using tools like 7-Zip or WinRAR, culminating in the execution of a randomized payload. Additionally, a parallel delivery method exploits the trusted Windows Installer component: msiexec.exe operates in embedded mode, writing a payload into C:UsersPublic and executing it under a signed Windows binary.

Later-stage files often masquerade as legitimate software. For instance, one payload was found posing as a Philips Speech Driver Client Configuration binary, complete with forged version metadata, while operating from a random directory. Another component impersonated Indigo Rose TrueUpdate Client, utilizing its update-like behavior to fetch additional payloads from an Alibaba Cloud Object Storage Service bucket over TLS.

Persistence is achieved through scheduled tasks with plausible yet unusual names, such as “Deadline Mission Target” and “Hierarchy Tools Smooth Inventory.” These tasks repeatedly launch payloads from C:ProgramData, establishing a recognizable execution cadence of approximately 60 seconds on affected machines.

The malware also creates transient SYSTEM-level scheduled tasks to add exclusions to Microsoft Defender, subsequently deleting those tasks to minimize forensic traces. Other evasion tactics observed include deleting shadow copies using vssadmin, altering file permissions, halting Windows Update services, renaming Windows Update DLLs, clearing the SoftwareDistribution cache, and implementing a malicious Windows Defender Application Control policy.

Furthermore, Microsoft detected process injection via CreateRemoteThread, with a persistent payload injecting itself into a legitimate user application shortly after launch. Command-and-control traffic utilized unusual ports, while cloud storage served as a staging channel when dedicated C2 infrastructure was unavailable.

Microsoft Defender identified activity across various stages, including delivery, execution, task creation, Defender tampering, C2 communications, and SMB lateral movement attempts. Attack Disruption measures automatically contained affected devices and accounts during qualifying incidents; however, organizations must still address persistence and investigate potential hands-on-keyboard activity.

To mitigate risks, organizations are encouraged to block software downloads from unofficial sources, enforce Tamper Protection, enable SmartScreen and Network Protection, and deploy Defender XDR controls. Microsoft also recommends implementing Attack Surface Reduction rules to block low-prevalence executables, obfuscated scripts, copied or impersonated system tools, and ransomware-related behaviors.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.