• About WordPress
    • WordPress.org
    • Documentation
    • Learn WordPress
    • Support
    • Feedback
Skip to content
May 26, 2026
  • Linkedin
  • Twitter
  • Facebook
  • Youtube

Daily CyberSecurity

Zero-hour alerts. Unmatched analysis.

Primary Menu
  • Home
  • CVE Watchtower
  • Cyber Criminals
  • Data Leak
  • Linux
  • Malware
  • Vulnerability
  • Submit Press Release
  • Vulnerability Report
Light/Dark Button
  • Home
  • News
  • Malware
  • Hacker forged Windows 11 upgrade website to trick users to download the virus
  • Malware

Hacker forged Windows 11 upgrade website to trick users to download the virus

Ddos April 19, 2022 2 minutes read
forged Windows 11 upgrade website

The Inno Stealer's infection chain (CloudSEK)

Previously, after Microsoft launched Windows 11, it attracted the attention of many users and set off an upgrade boom. Hackers will naturally not miss this opportunity to spread the virus. At that time, hackers made phishing websites to induce users to click, and when users downloaded the so-called upgrade program according to the prompt, what they actually downloaded was a virus.

Unexpectedly, such phishing websites have begun to appear again, and network security company, CloudSEK has found in their daily monitoring that there are fake Windows 11 upgrade websites. Both the domain name and the content of this website are fake, and of course, the virus is also downloaded immediately, which is basically similar to the phishing website that appeared before.

Although the routines are similar, the new virus that appears this time is indeed very rich in functions. After running, multiple modules will be released to perform specific tasks in different categories. For example, there are modules for creating scripts to disable Registry security, add Defender exceptions, uninstall security products, and delete the shadow volume.
The purpose is to steal the user’s cryptocurrency, and hackers will hijack browsers and cryptocurrency wallets to steal the keys. Common browsers such as Chrome, Edge, Brave, Opera, Vivaldi, 360 Browser, Comodo. etc. will be hijacked.
The Inno Stealer’s infection chain (CloudSEK)
To upgrade the system, the built-in check update function of the system is preferred. If this function cannot be upgraded, you can also use the official installation assistant provided by Microsoft. It is basically not recommended that users search for such content through search engines because it is easy to enter junk sites or phishing websites, and some phishing website users are difficult to distinguish.
Via: bleepingcomputer
Rate this post

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee Logo Buy Me a Coffee PayPal
Crypto QR Code
USDT (TRC20):
TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm
USDT (ERC20):
0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce

Share this article:

Facebook Post LinkedIn Telegram

Related posts:

  1. Turla use backdoored Flash installer attacks against embassies in Eastern European countries
  2. From QAKBOT to Custom Malware: The Adaptability of UNC4393
  3. Obfuscated JavaScript and WebDAV: Strela Stealer’s New Tools for Credential Theft
  4. Water Saci Evolves: Multi-Layered WhatsApp Worm Uses IMAP Email for Covert C2 and Session Hijacking
  5. Tangerine Turkey Cryptomining Worm Spreads Via USB Drives, Hides Payloads with VBScript and LOLBins
Tags: Hackers

Search

Translation

CVE WATCHTOWER
🚨

Receive alerts for vulnerabilities being exploited in the wild.

⚑

Get notified instantly when a Proof of Concept (PoC) exploit is published.

πŸ”

Access critical info on vulnerabilities even when marked as "RESERVED".

🧠

Insights powered by decades of expertise and global intelligence sources.

🎯

Customize alerts with up to 10 keywords for your specific tech stack.

πŸ“Š

Export the raw CVE database for SIEM integration and reporting.

Upgrade Package

πŸ”΄ Live Critical Threats

  • CVE-2026-3660CVSS 9.8
    IBM Engineering Lifecycle Management 7.0.3 ( through ) Interim Fix 021, 7.1.0...
  • CVE-2026-8633CVSS 9.8
    IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5,...
  • CVE-2026-46624CVSS 9.9
    Twenty is an open source CRM. From 1.7.7 through 1.16.7, a critical...
  • CVE-2026-44668CVSS 9.8
    FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to 1.8.3,...
  • CVE-2026-45721CVSS 9.0
    Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when...
  • CVE-2026-7251CVSS 9.8
    Eppendorf BioFlo 320Β is vulnerable to due to VNC server using a hard-coded...
  • CVE-2026-7374CVSS 9.9
    A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an...
  • CVE-2026-45247CVSS 9.8
    Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains...
  • CVE-2026-9543CVSS 9.8
    A vulnerability has been found in Totolink N300RH 6.1c.1353_B20190305. Affected is the...
  • CVE-2026-42774CVSS 9.3
    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')...
Powered by CVE WATCHTOWER

Recent Zero-Day Vulnerabilities

  • Exploited in the Wild: Critical OWA Spoofing Flaw (CVE-2026-42897) Hits On-Premises Exchange Servers
  • Exploited in the Wild: Maximum CVSS 10 SD-WAN Flaw (CVE-2026-20182) Grants Admin Control
  • Exploited in the Wild: Critical 9.8 CVSS RCE Hits Canon GUARDIANWALL MailSuite
  • Exploit Code Released: Public PoC Dumps for Windows BitLocker Bypass and SYSTEM Elevation Zero-Days
  • Exploited in the Wild: “Dirty Frag” Linux Vulnerability Grants Instant Root Access
  • Under Active Attack: Ivanti EPMM Zero-Day Exploited in the Wild via Harvested Admin Credentials
Our Websites
  • Penetration Testing Tools
  • The Daily Information Technology
  • Daily CyberSecurity

    • About SecurityOnline.info
    • Advertise with us
    • Announcement
    • Contact
    • Contributor Register
    • Login
    • About SecurityOnline.info
    • Advertise on SecurityOnline.info
    • Contact Us

    When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works

    • Disclaimer
    • Privacy Policy
    • DMCA NOTICE
    • Linkedin
    • Twitter
    • Facebook
    • Youtube
    Copyright Daily CyberSecurity Β© All rights reserved.