Article

Fake download sites are playing a long game

By ·

An editorial title card with the headline Fake download sites are playing a long game on the dark Readiness background with the green walking-man motif at right

In mid-July the developer of Wintoys, a Windows tweaking utility distributed only through the Microsoft Store, searched for his own app and found a website he did not build. The site at wintoys.app carried his app’s name, his old logo, and pages of helpful-sounding guides. It even had a download button, and the button linked to his real Microsoft Store listing. Nothing malicious. Nothing broken. That is exactly what makes it dangerous.

A fake with nothing wrong with it

The developer wrote up what he found, and it is worth reading in full. The fake site was a WordPress build stuffed with generic content, wrong in places, plausible everywhere. A footer note declared it “an independent site providing documentation, guides and links to the official project repositories”, which nobody reads and which excuses nothing. He checked the source. Clean. Any reputation scanner would agree: safe site, real download, move along.

A fake download site in its trust-building phase is supposed to look like this. The traffic it gathers today is the weapon it fires later.

One anonymised email, 72 domains

The domain was registered through Epik, which bundles free lifetime WHOIS privacy, so the owner is anonymous. But Epik assigns each customer a unique anonymised contact address, and by pivoting on that address he surfaced 72 domains registered to the same owner. Nearly all of them target Windows software.

The list reads like a packager’s backlog. PowerToys, twice: powertoys.app and power-toys.com. Chris Titus Tech’s WinUtil, also twice: winutil.app and christitustool.com. EasyBCD. CrystalDiskMark and CrystalDiskInfo. FreeFileSync. Hard Disk Sentinel. A stack of NirSoft utilities: NirCmd, SearchMyFiles, USBLogView, ShellMenuView. Then it gets stranger: hashcat, darktable, and documentation-shaped domains for developer libraries and tools such as PyJWT, mongosh, mimalloc and OCRmyPDF. The registrations came in waves between February and May 2026, and many of the sites are unfinished. This is an operation still under construction, discovered before the interesting part.

The playbook is already documented

We know the interesting part because Check Point documented the previous run. The Hacker News covered it in June: fake sites impersonating Ghidra, dnSpy and SpiderFoot, SEO-tuned until they ranked above the official projects. The sites sat benign for months, gathering rank and trust. Then a traffic distribution system (TDS) was quietly embedded, and from January 2026 the same infrastructure began serving malware: a multi-stage loader, an infostealer that targets browsers, crypto wallets and password managers, and a clipboard hijacker that swaps wallet addresses.

The delivery layer is built to defeat exactly the checks an IT department would run. It tracks first visits, runs anti-bot checks, filters out data centre and VPN addresses, and caps how often it fires. Repeat visitors from the same address get a legitimate installer. A scanner that checks the download link twice gets a clean file twice. The site is not clean or dirty; it is clean for you, dirty for your users, one visitor at a time.

The flip has started elsewhere

This is not hypothetical patience. A Lively Wallpaper user reported a third-party site serving a trojanised installer that planted a persistent remote-access service and bandwidth-sharing software, and the maintainer followed with a warning about impersonation sites. A warning to the SignalRGB community named a fake site at signalrgb.io distributing malware. Neither domain appears among the 72, which is the worst part: this is not one actor running one campaign, it is a business model with multiple operators.

Takedowns, meanwhile, move at the speed of paperwork. The Wintoys developer reported the operation to Epik, which terminated service and ordered the domains transferred. Two weeks later, on 22 July, all 72 domains had simply moved to another registrar. The content host sits behind a proxy layer that has to be asked, politely and separately, who is actually hosting the files. Registration is automated and instant. Abuse handling is manual and slow. The economics favour the attacker.

If your job includes finding installers

Read that domain list again and ask who actually types “CrystalDiskMark download” into a search engine. Home users, yes. But also packagers, service-desk staff, and engineers mid-ticket with a deadline. This operation is aimed at whoever sources software by searching for it, and in most organisations that includes the people who build the install estate. We wrote earlier about security tools becoming the attack surface. This is the next step: the download page itself is the attack surface, and it activates on a timer.

The structural problem is that point-in-time vetting cannot see a time bomb. A site checked and approved in June can turn hostile in September without changing its URL, its ranking, or its look. Trust in a download source decays, and the TDS gating means even re-checking it tells you nothing.

What works is provenance, pinned once and enforced by pipeline:

  • Record the canonical source for every application: the vendor’s own site, the store listing, the project repository. Once, deliberately, with the URL verified.
  • Verify hashes or signatures against vendor-published values on every fetch, not just the first.
  • Let automation do the fetching. An evergreen pipeline that pulls each new release from the pinned source never searches, never clicks a result, and never meets the TDS.
  • Treat any installer that arrived via a search result as unverified input, however clean the site looked.

This is why our evergreen catalogue pins every application to its canonical source and re-fetches from that source on every release. The pipeline never googles. People do, and that habit is the door this whole operation is built around.

The Wintoys developer closes his write-up with advice for users: check where you download from, report the fakes, warn the developer. All sound. For enterprises the lesson is blunter. Dozens of those 72 domains are just sitting there today, being helpful and harmless. That is the plan.

Sources

#security#packaging#supply-chain