Fake Windows 11 Upgrade will steal your Personal & Credit Card Info

February 14, 2022

Threat actors have started distributing fake Windows 11 upgrade installers to users of Windows 10, tricking them into downloading and executing RedLine Stealer malware.

These attacks coincides Microsoft’s announcement of a broad deployment phase for Windows 11, which has given attackers plenty of time to prepare for this move. RedLine is currently the most widely deployed password, browser cookies, credit card, and cryptocurrency wallet info grabber. According to researchers at HP, the actors used the seemingly legitimate “windows-upgraded.com” domain to distribute the malware.

Phony website used for malware distribution — Fake website used for malware distribution (HP) – Currently taken down

This campaign highlights once again how attackers are quick to take advantage of important, relevant and interesting current events to create effective lures. Although the distribution site is down now, nothing stops the actors from setting up a new domain and restarting their campaign. In fact, this is very likely already happening in the wild. Remember, these dangerous sites are promoted via forum and social media posts or instant messages, so don’t trust anything but the official Windows upgrade system alerts.