Topic
Attackers ranking counterfeit download sites above legitimate project sources in search results.
Huntress traced an MSP administrator's October 7 Bing search to watchguard-vpn[.]net, a WatchGuard lookalike that served a genuine signed installer. The domain was offline by October 13, and earlier WatchGuard and Microsoft reports had described fake clients.
Reality
McAfee says the WeedHack stealer's control server is dead and its renter dashboard gone, but ten impersonation sites and the search rankings behind them are still delivering victims.
Perspective Coverage
3 publishersReality
Palo Alto Networks Unit 42 says the pay-per-install marketplace fed gamers and professionals into the same loader, OfferLoader, and its trojanized installers reached corporate endpoints at critical infrastructure and government entities.
Reality
LastPass TIME and Delphos Labs analysed a malware-as-a-service kit that arrives as a padded ZIP from an SEO-boosted fake repository and ends with a signed driver terminating security processes from kernel mode.
Reality
LastPass and Delphos Labs traced SEO-tuned GitHub repositories impersonating at least 40 software brands to a new stealer called Rapuncel, shipped alongside a signed kernel driver that opens protected security processes as kernel code and terminates them.
Reality
Huntress tracked nine months of malware campaigns run through shipped AI sharing features. Public Claude Artifacts, claude.ai/share links and indexable ChatGPT and Grok conversations all put the lure on a domain the victim already trusts.
Reality
Unit 42's CL-CRI-1171 sold installs to other criminals for at least two years, funneling gamers through YouTube and professionals through poisoned search results, while its loader stayed unnamed because nobody escalated it.
Reality
MayaBot only shows up in 2022, seven years into the operation, and one branch of the funnel ends in a phone call to a scam call centre. That leaves the search referral and the redirector domains as the constants worth detecting.
Reality