This fake Windows support website delivers password-stealing malware

Accompanying the Electron shell is AppLauncher.vbs, a Visual Basic Script that serves as the initial launcher. The system’s built-in cscript.exe interpreter executes the VBS, which subsequently launches the Electron app—a classic living-off-the-land technique that avoids direct payload execution and maintains a routine appearance in process logs.

However, the Electron wrapper is merely the outer layer. Once operational, WindowsUpdate.exe spawns _winhost.exe, a renamed Python 3.10 interpreter disguised as a legitimate Windows process. This process unpacks a full Python runtime into C:UsersAppDataLocalTempWinGettools, including python.exe and supporting libraries.

It then installs a suite of Python packages commonly associated with data theft tools:

• pycryptodome, used for encrypting stolen data
• psutil, utilized to inspect running processes and detect sandbox environments
• pywin32, which enables deep access to the Windows API
• PythonForWindows, used to interact with system internals such as processes and privileges

Analysis of the Electron app’s JavaScript reveals two heavily obfuscated files processed using techniques like control-flow flattening and opaque predicates, containing the core functionality. The larger file (~7 MB) serves as the primary stealer payload, referencing pbkdf2, sha256, and AES decryption routines, along with a campaign expiry check. The smaller file (~1 MB) targets Discord, modifying its code to intercept login tokens, payment details, and two-factor authentication changes when the app is opened.

Both files returned zero detections across major antivirus engines, illustrating how malware can conceal itself within legitimate software and utilize heavily obfuscated code.

Two ways it survives a reboot

The malware employs two independent persistence mechanisms. First, reg.exe writes a value called SecurityHealth under the user’s CurrentVersionRun registry key, pointing to WindowsUpdate.exe. This value name masquerades as Windows Security Health, the service responsible for Defender notifications, something most users and even IT personnel would overlook.

Second, cscript.exe creates a shortcut file named Spotify.lnk in the user’s Startup folder. Anyone who notices it might assume Spotify configured itself to launch at login.

These two persistence mechanisms, each disguised as something users would expect to see, enhance the malware's longevity.

Fingerprinting the victim, phoning home, uploading the haul

Within moments of launching, WindowsUpdate.exe connects to www.myexternalip.com and ip-api.com to ascertain the victim’s public IP address and geolocation. This reconnaissance is a common trait among infostealers, providing the operator with the victim's location and potentially influencing the type of data collected.

The malware subsequently contacts its command-and-control (C2) infrastructure, reaching out to datawebsync-lvmv.onrender[.]com, a C2 endpoint hosted on Render, and sync-service.system-telemetry.workers[.]dev, a relay operating on Cloudflare Workers. The latter domain is particularly insidious; “system-telemetry” is the kind of subdomain a network analyst might dismiss as legitimate monitoring traffic during a cursory log review.

For data exfiltration, the malware utilizes store8.gofile[.]io, a file-sharing service that facilitates anonymous uploads. Gofile has become a preferred choice among commodity stealers due to its ephemeral nature and lack of a paper trail for operators.

Hundreds of processes killed before breakfast

Sandbox telemetry captured over two hundred separate invocations of taskkill.exe, each executed as an individual process. While the specific target processes were not recorded in the condensed telemetry, the sheer volume and pattern align with infostealers that systematically terminate security tools, browser processes (to unlock credential databases), and competing malware before initiating their collection routine. The strategy is clear: eliminate anything that might interfere, then proceed with the task at hand.

Why the automated defenses gave it a pass

At the time of analysis, VirusTotal reported zero detections across 69 engines for the main executable and 62 for the VBS launcher. No YARA rules matched, and behavioral scoring classified the activity as low risk. This outcome is not indicative of a failure of any single tool; rather, it reflects the intended design of the malware.

The Electron shell is a legitimate binary utilized by millions of applications. The malicious logic is concealed within obfuscated JavaScript, which traditional antivirus tools often overlook. The Python payload operates under a misleading process name and dynamically pulls in components from seemingly normal sources.

Individually, each component appears harmless. It is only when one traces the entire chain—from VBS launcher to Electron app to renamed Python process to data collection and exfiltration—that the malicious nature becomes evident.

What this means and what to do next

The combination of a localized phishing lure, a legitimately constructed MSI installer, an Electron wrapper, and a runtime-deployed Python payload exemplifies the evolution of commodity stealers. Each layer serves a specific purpose: the MSI offers a familiar installation experience, the Electron shell helps the file appear clean, and the Python runtime provides flexible access to the operating system. The entire chain is built from off-the-shelf, legitimate components.

The targeting of French users follows a clear pattern. With tens of millions of personal records already in circulation, the cost of creating a convincing localized lure diminishes significantly. An attacker who knows which provider a victim uses can tailor a phishing page to match their expectations, whether from their ISP or, in this instance, Microsoft.

The crucial takeaway is that a zero-detection result on VirusTotal does not guarantee a file's safety. It often indicates that the malicious logic is concealed, such as within obfuscated scripts or delivered at runtime, leaving little for traditional detection methods to flag.

If you suspect you may have installed this update, consider taking the following steps:

• Check your registry key. Press Windows + R, type regedit, and press Enter. Navigate to HKCUSOFTWAREMicrosoftWindowsCurrentVersionRun. Look for an entry named SecurityHealth pointing to WindowsUpdate.exe in your AppData folder, and delete it.
• Search for a Spotify.lnk file in your Startup folder that you did not create, and remove it. Delete the folder C:UsersAppDataLocalProgramsWindowsUpdate.
• Clear the temporary files in C:UsersAppDataLocalTempWinGettools.
• Change all passwords stored in your browser—assume that saved credentials, cookies, and session tokens may have been compromised.
• Enable two-factor authentication, prioritizing email and financial accounts.
• Run a full system scan with an up-to-date antimalware tool (preferably one with behavioral detection).