Threats Tagged 'download studio'

A network of 41 fraudulent websites impersonates popular games and Windows software, using authentic product information and real download links to deceive users. These sites employ JavaScript to show legitimate URLs on hover but redirect users to the Download Studio installer upon clicking. The campaign targets users seeking common software and security tools, pushing them through affiliate redirects. Download Studio's automatic updater was compromised in 2020 to distribute malware, raising concerns about potential risks, although no current malicious activity is confirmed.

A sophisticated backdoor disguised as a legitimate Malwarebytes installer was distributed to over 100,000 machines through compromised automatic updates of one torrent client (Download Studio) and three adblockers (NetShield Kit, My AdBlock, and Net AdBlock). The backdoor creates a fake Malwarebytes installation directory containing legitimate signed files alongside malicious DLL files. Once executed, it establishes persistence through a Windows service and communicates with command-and-control servers to receive configuration updates and additional payloads. The primary observed payloads were cryptocurrency miners, though the infrastructure supports delivery of multiple persistent threats. The attack demonstrates abuse of software update mechanisms and affects primarily users in Russia, Ukraine, and Kazakhstan.

MediumMalwareKazakhstanRussiaUkraine#download studio#cryptocurrency mining#software update abuse