CampaignPublished 9 Apr 2026

This fake Windows support website delivers password-stealing malware

Source AlienVault OTX General

Description

A malicious campaign is targeting French-speaking users in an attempt to steal passwords, payment details and banking details from people across France, according to researchers at the Institute for Strategic Studies (ISS).

Impact

The campaign can lead to theft of passwords, payment details, and banking information from victims, potentially resulting in financial loss and compromised accounts. The impact is localized to French-speaking users, especially in France, but no broader geographic targeting is confirmed. There is no evidence of widespread exploitation or active threat actor attribution at this time.

Defensive guidance

Defenders should block access to the domain microsoft-update.support and monitor for the associated file hashes. User education to recognize fake support websites and avoid downloading software from untrusted sources is recommended. Follow updates from trusted threat intelligence sources for any changes.

Summary

This campaign involves a fraudulent website impersonating Windows support to distribute malware designed to steal user credentials and financial information. It targets French-speaking users, leveraging social engineering and technical methods such as code obfuscation and persistence mechanisms (indicated by tags like T1036, T1547, T1140, T1105, T1059, T1027). The malware delivery involves scripts and possibly Electron-based applications. Indicators include the malicious domain microsoft-update.support and several file hashes. There is no CVE or patch associated with this campaign, and no known exploits in the wild have been reported.

Indicators of compromise

Domains 1

microsoft-update.support

Hashes 4

08ccc359f9e0851d49e942cd47e5cf55MD5 of c94de13f548ce39911a1c55a5e0f43cddd681deb5a5a9c4de8a0dfe5b082f650
f15a70fccc42a07306d5987e35e1a5b2f070999eSHA1 of c94de13f548ce39911a1c55a5e0f43cddd681deb5a5a9c4de8a0dfe5b082f650
13c97012b0df84e6491c1d8c4c5dc85f35ab110d067c05ea503a75488d63be60
c94de13f548ce39911a1c55a5e0f43cddd681deb5a5a9c4de8a0dfe5b082f650

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 9 Apr 2026, 18:06 UTC

MITRE ATT&CK techniques6 from threat tags

Technical details

Indicators of compromise

Domains 1

Hashes 4

Community reviews

Related threats