A fake Microsoft support website is tricking people into downloading what looks like a normal Windows update. Instead, it installs malware designed to steal passwords, payment details, and account access. Because the file looks legitimate and avoids detection, it can slip past both users and security tools.<\/p>\n
A very convincing Windows update<\/strong><\/h2>\nWe spotted the campaign at microsoft-update[.]support<\/code>, a typosquatted domain dressed up to look like an official Microsoft support page. The site is written entirely in French (but these campaigns tend to spread quickly) and presents a fake cumulative update for Windows version 24H2, complete with a plausible KB article number. A large blue download button invites users to install the update. <\/p>\nFake Windows update site. Look at that convincing URL!<\/figcaption><\/figure>\nWhat gets downloaded is WindowsUpdate 1.0.0.msi,<\/code> an 83 MB Windows Installer package. At first glance, everything looks legitimate. Its file properties are carefully spoofed: the Author field reads \u201cMicrosoft,\u201d the title reads \u201cInstallation Database,\u201d and the Comments field claims it contains \u201cthe logic and data required to install WindowsUpdate.\u201d <\/p>\nThe package was built with WiX Toolset 4.0.0.5512, a legitimate open-source installer framework, and was created on April 4, 2026.<\/p>\n![\"Fake](\"https:\/\/www.malwarebytes.com\/wp-content\/uploads\/sites\/2\/2026\/04\/microsoft-update-fake-URL-installer-package-SD.png\")
<\/figure>\nWhy this campaign is targeting France<\/strong><\/h2>\nThe choice to target French-speaking users is not random. France has suffered a historic cascade of data breaches over the past two years, leaving a staggering volume of personal information circulating on criminal marketplaces. The breaches provide the raw data, and campaigns like this one turn that into highly believable scams.<\/p>\n
In October 2024, Free, France\u2019s second-largest internet service provider, confirmed that an attacker had accessed personal data<\/a> for roughly 19 million subscriber contracts, including bank account details. Just weeks earlier, Soci\u00e9t\u00e9 Fran\u00e7aise du Radiot\u00e9l\u00e9phone (SFR) disclosed its own breach<\/a> exposing customer names, addresses, phone numbers, and banking details.<\/p>\nEarlier in 2024, France Travail, the national public employment service, suffered an intrusion that compromised the records of 43 million people<\/a>, covering current and past jobseekers spanning two decades. Researchers also discovered<\/a> an unprotected Elasticsearch server aggregating 90 million records from at least 17 separate French breaches into a single database.<\/p>\nThis torrent of leaked data has made France an attractive target for credential theft. KELA\u2019s 2025 infostealer research<\/a> identified France among the top countries for victims, alongside Brazil, India, the US, Spain, the United Kingdom, and Indonesia. <\/p>\nWhen attackers already have a victim\u2019s name, address, and ISP from a previous leak, a French-language \u201cWindows update\u201d page becomes a far more convincing lure than a generic English one.<\/p>\n
Electron on the outside, Python on the inside<\/strong><\/h2>\nWhen the MSI executes, it installs an Electron application (essentially a stripped-down Chromium browser bundled with custom JavaScript) to C:UsersAppDataLocalProgramsWindowsUpdate<\/user><\/code>. <\/p>\nThe main binary, WindowsUpdate.exe<\/code>, is a renamed copy of the standard Electron shell\u2014VirusTotal\u2019s metadata identifies it as electron.exe.<\/code> Across 69 antivirus engines, it drew zero detections because the executable itself is clean. This suggests the malicious logic lives inside the Electron app\u2019s bundled JavaScript (typically packaged as app.asar<\/code>).<\/p>\nAlongside the Electron shell sits AppLauncher.vbs<\/code>, a Visual Basic Script that acts as the initial launcher. The system\u2019s built-in cscript.exe<\/code> interpreter runs the VBS, which then starts the Electron app\u2014a classic living-off-the-land technique that avoids launching the payload directly and keeps the execution chain looking routine in process logs.<\/p>\nBut the Electron wrapper is only the outer layer. Once running, WindowsUpdate.exe<\/code> spawns _winhost.exe<\/code>, a renamed Python 3.10 interpreter disguised to resemble a legitimate Windows process. This process unpacks a full Python runtime into
C:UsersAppDataLocalTempWinGettools<\/user><\/code>, including python.exe<\/code> and supporting libraries.<\/p>\nIt then installs a set of Python packages commonly seen in data theft tools:<\/p>\n
\n- pycryptodome, used to encrypt stolen data<\/li>\n
- psutil, used to inspect running processes and detect sandbox environments<\/li>\n
- pywin32, which enables deep access to the Windows API<\/li>\n
- PythonForWindows, used to interact with system internals such as processes and privileges<\/li>\n<\/ul>\n
Analysis of the Electron app\u2019s JavaScript confirms this. Two heavily obfuscated files, processed using techniques like control-flow flattening and opaque predicates, contain the core functionality.<\/p>\n
The larger file (~7 MB) is the main stealer payload, with references to pbkdf2, sha256, and AES decryption routines, as well as a campaign expiry check. The smaller file (~1 MB) targets Discord: because Discord runs on Electron, the script modifies its code to intercept login tokens, payment details, and two-factor authentication changes when the app is opened.<\/p>\n
Both files returned zero detections across major antivirus engines\u2014the result of malware that hides inside legitimate software and heavily obfuscated code.<\/p>\n
Two ways it survives a reboot<\/strong><\/h2>\nThe malware sets up two independent persistence mechanisms. <\/p>\n
First, reg.exe<\/code> writes a value called SecurityHealth<\/code> under the user\u2019s CurrentVersionRun registry key, pointing to WindowsUpdate.exe.<\/code> The value name impersonates Windows Security Health, the service responsible for Defender notifications. It\u2019s something most users and even IT staff would scroll past without suspicion.<\/p>\nSecond, cscript.exe<\/code> drops a shortcut file named Spotify.lnk<\/code> into the user\u2019s Startup folder. Anyone who notices it would likely assume Spotify had configured itself to launch at login. <\/p>\nTwo persistence mechanisms, two different disguises, each designed to look like something the user would expect to see.<\/p>\n
Fingerprinting the victim, phoning home, uploading the haul<\/strong><\/h2>\nWithin seconds of launching, WindowsUpdate.exe<\/code> reaches out to www.myexternalip.com<\/code> and ip-api.com<\/code> to discover the victim\u2019s public IP address and geolocation. This kind of reconnaissance is a near-universal trait of infostealers, telling the operator where the victim is and may determine what data gets collected.<\/p>\nThe malware then contacts its command-and-control (C2) infrastructure. It reaches datawebsync-lvmv.onrender[.]com<\/code>, a C2 endpoint hosted on Render, and sync-service.system-telemetry.workers[.]dev<\/code>, a relay running on Cloudflare Workers. That second domain is particularly crafty: \u201csystem-telemetry\u201d is exactly the kind of subdomain a network analyst might dismiss as legitimate monitoring traffic during a quick log review.<\/p>\nFor exfiltration, the malware turns to store8.gofile[.]io<\/code>, a file-sharing service that allows anonymous uploads. Gofile has become a favourite among commodity stealers because it is free, ephemeral, and produces no paper trail for the operator.<\/p>\nHundreds of processes killed before breakfast<\/strong><\/h2>\nSandbox telemetry captured more than two hundred separate invocations of taskkill.exe<\/code>, each launched as an individual process. While the specific target processes were not recorded in the condensed telemetry, the sheer volume and pattern is consistent with infostealers that systematically terminate security tools, browser processes (to unlock credential databases), and competing malware before beginning their collection routine. Kill everything that might interfere, then get to work.<\/p>\nWhy the automated defences gave it a pass<\/strong><\/h2>\nAt the time of analysis, VirusTotal showed zero detections across 69 engines for the main executable and 62 for the VBS launcher. No YARA rules matched, and behavioural scoring classified the activity as low risk.<\/p>\n
This is not a failure of any single tool. It\u2019s the intended result of the malware\u2019s architecture.\u00a0<\/p>\n
The Electron shell is a legitimate binary used by millions of applications. The malicious logic is hidden inside obfuscated JavaScript, which traditional antivirus tools don\u2019t deeply inspect. The Python payload runs under a misleading process name and pulls in components at runtime from what appear to be normal sources.<\/p>\n
Individually, each piece looks harmless. It\u2019s only when you follow the full chain\u2014VBS launcher to Electron app to renamed Python process to data collection and exfiltration\u2014that the activity becomes clearly malicious.<\/p>\n
Since our analysis, we\u2019ve added detections to protect users from this threat.<\/p>\n
What this means and what to do next<\/strong><\/h2>\nThe combination of a localized phishing lure, a legitimately built MSI installer, an Electron wrapper, and a runtime-deployed Python payload shows how commodity stealers are evolving. Each layer serves a purpose: the MSI provides a familiar installation experience, the Electron shell helps the file appear clean, and the Python runtime gives flexible access to the operating system. The entire chain is built from off-the-shelf, legitimate components.<\/p>\n
The targeting of French users follows a clear pattern. When tens of millions of personal records are already circulating, the cost of creating a convincing localized lure drops significantly. An attacker who already knows which provider a victim uses can tailor a phishing page to match what they expect to see, whether that\u2019s from their ISP or, in this case, Microsoft.<\/p>\n
The most important takeaway is that a zero-detection VirusTotal result does not mean a file is safe. It often means the malicious logic is hidden, e.g. inside obfuscated scripts or delivered at runtime, leaving little for traditional detection methods to flag.<\/p>\n
If you think you may have installed this update, here\u2019s what to do:<\/p>\n
\n- Check your registry key. To do this, press Windows + R<\/strong>, type
regedit<\/code>, and press Enter. Go to HKCUSOFTWAREMicrosoftWindowsCurrentVersionRun<\/code>. Look for an entry named SecurityHealth<\/code> pointing to WindowsUpdate.exe<\/code> in your AppData folder, and delete it.<\/li>\n- Look for a
Spotify.lnk<\/code> file in your Startup folder that you didn\u2019t create, and remove it Delete the folder C:UsersAppDataLocalProgramsWindowsUpdate <\/user><\/code><\/li>\n- Clear the temporary files in
C:UsersAppDataLocalTempWinGettools <\/user><\/code><\/li>\n- Change all passwords stored in your browser\u2014assume saved credentials, cookies, and session tokens may have been compromised<\/li>\n
- Enable two-factor authentication, prioritizing email and financial accounts<\/li>\n
- Run a full system scan with an up-to-date antimalware tool<\/a> (ideally one with behavioural detection)<\/li>\n<\/ul>\n
How to update Windows safely<\/h2>\n
The safest way to update Windows is through the built-in update feature. Open Start<\/strong>, go to Settings > Windows Update<\/strong>, and click \u201cCheck for updates.\u201d This should always be your first port of call.<\/p>\n![\"\"](\"https:\/\/www.malwarebytes.com\/wp-content\/uploads\/sites\/2\/2026\/04\/settings-windows-update.png?w=1024\")
<\/figure>\nMicrosoft does offer standalone update packages through the Microsoft Update Catalog (catalog.update.microsoft.com<\/code>), but this is the only legitimate source for manual downloads. Any other website offering a Windows update as a file should be treated as suspicious.<\/p>\nBe wary of pages that mimic Microsoft Support or Windows Update. These can look convincing, but the URL is what matters. Legitimate Microsoft pages are only served from domains ending in microsoft.com<\/strong>. A domain like microsoft-update[.]support<\/code> may look plausible, but it is not connected to Microsoft.<\/p>\nIf you receive an email, text, or notification urging you to install an urgent update, don\u2019t click the link. Instead, open Settings > Windows Update<\/strong> and check directly.<\/p>\nFinally, consider enabling automatic updates. This removes the need to download updates manually and reduces the chance of being tricked into installing a fake one.<\/p>\n
Indicators of Compromise (IOCs)<\/strong><\/h2>\nFile Hashes (SHA-256)<\/strong><\/p>\n
microsoft-update[.]support<\/code>, a typosquatted domain dressed up to look like an official Microsoft support page. The site is written entirely in French (but these campaigns tend to spread quickly) and presents a fake cumulative update for Windows version 24H2, complete with a plausible KB article number. A large blue download button invites users to install the update. <\/p>\nFake Windows update site. Look at that convincing URL!<\/figcaption><\/figure>\nWhat gets downloaded is WindowsUpdate 1.0.0.msi,<\/code> an 83 MB Windows Installer package. At first glance, everything looks legitimate. Its file properties are carefully spoofed: the Author field reads \u201cMicrosoft,\u201d the title reads \u201cInstallation Database,\u201d and the Comments field claims it contains \u201cthe logic and data required to install WindowsUpdate.\u201d <\/p>\nThe package was built with WiX Toolset 4.0.0.5512, a legitimate open-source installer framework, and was created on April 4, 2026.<\/p>\n<\/figure>\nWhy this campaign is targeting France<\/strong><\/h2>\nThe choice to target French-speaking users is not random. France has suffered a historic cascade of data breaches over the past two years, leaving a staggering volume of personal information circulating on criminal marketplaces. The breaches provide the raw data, and campaigns like this one turn that into highly believable scams.<\/p>\n
In October 2024, Free, France\u2019s second-largest internet service provider, confirmed that an attacker had accessed personal data<\/a> for roughly 19 million subscriber contracts, including bank account details. Just weeks earlier, Soci\u00e9t\u00e9 Fran\u00e7aise du Radiot\u00e9l\u00e9phone (SFR) disclosed its own breach<\/a> exposing customer names, addresses, phone numbers, and banking details.<\/p>\nEarlier in 2024, France Travail, the national public employment service, suffered an intrusion that compromised the records of 43 million people<\/a>, covering current and past jobseekers spanning two decades. Researchers also discovered<\/a> an unprotected Elasticsearch server aggregating 90 million records from at least 17 separate French breaches into a single database.<\/p>\nThis torrent of leaked data has made France an attractive target for credential theft. KELA\u2019s 2025 infostealer research<\/a> identified France among the top countries for victims, alongside Brazil, India, the US, Spain, the United Kingdom, and Indonesia. <\/p>\nWhen attackers already have a victim\u2019s name, address, and ISP from a previous leak, a French-language \u201cWindows update\u201d page becomes a far more convincing lure than a generic English one.<\/p>\n
Electron on the outside, Python on the inside<\/strong><\/h2>\nWhen the MSI executes, it installs an Electron application (essentially a stripped-down Chromium browser bundled with custom JavaScript) to C:UsersAppDataLocalProgramsWindowsUpdate<\/user><\/code>. <\/p>\nThe main binary, WindowsUpdate.exe<\/code>, is a renamed copy of the standard Electron shell\u2014VirusTotal\u2019s metadata identifies it as electron.exe.<\/code> Across 69 antivirus engines, it drew zero detections because the executable itself is clean. This suggests the malicious logic lives inside the Electron app\u2019s bundled JavaScript (typically packaged as app.asar<\/code>).<\/p>\nAlongside the Electron shell sits AppLauncher.vbs<\/code>, a Visual Basic Script that acts as the initial launcher. The system\u2019s built-in cscript.exe<\/code> interpreter runs the VBS, which then starts the Electron app\u2014a classic living-off-the-land technique that avoids launching the payload directly and keeps the execution chain looking routine in process logs.<\/p>\nBut the Electron wrapper is only the outer layer. Once running, WindowsUpdate.exe<\/code> spawns _winhost.exe<\/code>, a renamed Python 3.10 interpreter disguised to resemble a legitimate Windows process. This process unpacks a full Python runtime into
C:UsersAppDataLocalTempWinGettools<\/user><\/code>, including python.exe<\/code> and supporting libraries.<\/p>\nIt then installs a set of Python packages commonly seen in data theft tools:<\/p>\n
\n- pycryptodome, used to encrypt stolen data<\/li>\n
- psutil, used to inspect running processes and detect sandbox environments<\/li>\n
- pywin32, which enables deep access to the Windows API<\/li>\n
- PythonForWindows, used to interact with system internals such as processes and privileges<\/li>\n<\/ul>\n
Analysis of the Electron app\u2019s JavaScript confirms this. Two heavily obfuscated files, processed using techniques like control-flow flattening and opaque predicates, contain the core functionality.<\/p>\n
The larger file (~7 MB) is the main stealer payload, with references to pbkdf2, sha256, and AES decryption routines, as well as a campaign expiry check. The smaller file (~1 MB) targets Discord: because Discord runs on Electron, the script modifies its code to intercept login tokens, payment details, and two-factor authentication changes when the app is opened.<\/p>\n
Both files returned zero detections across major antivirus engines\u2014the result of malware that hides inside legitimate software and heavily obfuscated code.<\/p>\n
Two ways it survives a reboot<\/strong><\/h2>\nThe malware sets up two independent persistence mechanisms. <\/p>\n
First, reg.exe<\/code> writes a value called SecurityHealth<\/code> under the user\u2019s CurrentVersionRun registry key, pointing to WindowsUpdate.exe.<\/code> The value name impersonates Windows Security Health, the service responsible for Defender notifications. It\u2019s something most users and even IT staff would scroll past without suspicion.<\/p>\nSecond, cscript.exe<\/code> drops a shortcut file named Spotify.lnk<\/code> into the user\u2019s Startup folder. Anyone who notices it would likely assume Spotify had configured itself to launch at login. <\/p>\nTwo persistence mechanisms, two different disguises, each designed to look like something the user would expect to see.<\/p>\n
Fingerprinting the victim, phoning home, uploading the haul<\/strong><\/h2>\nWithin seconds of launching, WindowsUpdate.exe<\/code> reaches out to www.myexternalip.com<\/code> and ip-api.com<\/code> to discover the victim\u2019s public IP address and geolocation. This kind of reconnaissance is a near-universal trait of infostealers, telling the operator where the victim is and may determine what data gets collected.<\/p>\nThe malware then contacts its command-and-control (C2) infrastructure. It reaches datawebsync-lvmv.onrender[.]com<\/code>, a C2 endpoint hosted on Render, and sync-service.system-telemetry.workers[.]dev<\/code>, a relay running on Cloudflare Workers. That second domain is particularly crafty: \u201csystem-telemetry\u201d is exactly the kind of subdomain a network analyst might dismiss as legitimate monitoring traffic during a quick log review.<\/p>\nFor exfiltration, the malware turns to store8.gofile[.]io<\/code>, a file-sharing service that allows anonymous uploads. Gofile has become a favourite among commodity stealers because it is free, ephemeral, and produces no paper trail for the operator.<\/p>\nHundreds of processes killed before breakfast<\/strong><\/h2>\nSandbox telemetry captured more than two hundred separate invocations of taskkill.exe<\/code>, each launched as an individual process. While the specific target processes were not recorded in the condensed telemetry, the sheer volume and pattern is consistent with infostealers that systematically terminate security tools, browser processes (to unlock credential databases), and competing malware before beginning their collection routine. Kill everything that might interfere, then get to work.<\/p>\nWhy the automated defences gave it a pass<\/strong><\/h2>\nAt the time of analysis, VirusTotal showed zero detections across 69 engines for the main executable and 62 for the VBS launcher. No YARA rules matched, and behavioural scoring classified the activity as low risk.<\/p>\n
This is not a failure of any single tool. It\u2019s the intended result of the malware\u2019s architecture.\u00a0<\/p>\n
The Electron shell is a legitimate binary used by millions of applications. The malicious logic is hidden inside obfuscated JavaScript, which traditional antivirus tools don\u2019t deeply inspect. The Python payload runs under a misleading process name and pulls in components at runtime from what appear to be normal sources.<\/p>\n
Individually, each piece looks harmless. It\u2019s only when you follow the full chain\u2014VBS launcher to Electron app to renamed Python process to data collection and exfiltration\u2014that the activity becomes clearly malicious.<\/p>\n
Since our analysis, we\u2019ve added detections to protect users from this threat.<\/p>\n
What this means and what to do next<\/strong><\/h2>\nThe combination of a localized phishing lure, a legitimately built MSI installer, an Electron wrapper, and a runtime-deployed Python payload shows how commodity stealers are evolving. Each layer serves a purpose: the MSI provides a familiar installation experience, the Electron shell helps the file appear clean, and the Python runtime gives flexible access to the operating system. The entire chain is built from off-the-shelf, legitimate components.<\/p>\n
The targeting of French users follows a clear pattern. When tens of millions of personal records are already circulating, the cost of creating a convincing localized lure drops significantly. An attacker who already knows which provider a victim uses can tailor a phishing page to match what they expect to see, whether that\u2019s from their ISP or, in this case, Microsoft.<\/p>\n
The most important takeaway is that a zero-detection VirusTotal result does not mean a file is safe. It often means the malicious logic is hidden, e.g. inside obfuscated scripts or delivered at runtime, leaving little for traditional detection methods to flag.<\/p>\n
If you think you may have installed this update, here\u2019s what to do:<\/p>\n
\n- Check your registry key. To do this, press Windows + R<\/strong>, type
regedit<\/code>, and press Enter. Go to HKCUSOFTWAREMicrosoftWindowsCurrentVersionRun<\/code>. Look for an entry named SecurityHealth<\/code> pointing to WindowsUpdate.exe<\/code> in your AppData folder, and delete it.<\/li>\n- Look for a
Spotify.lnk<\/code> file in your Startup folder that you didn\u2019t create, and remove it Delete the folder C:UsersAppDataLocalProgramsWindowsUpdate <\/user><\/code><\/li>\n- Clear the temporary files in
C:UsersAppDataLocalTempWinGettools <\/user><\/code><\/li>\n- Change all passwords stored in your browser\u2014assume saved credentials, cookies, and session tokens may have been compromised<\/li>\n
- Enable two-factor authentication, prioritizing email and financial accounts<\/li>\n
- Run a full system scan with an up-to-date antimalware tool<\/a> (ideally one with behavioural detection)<\/li>\n<\/ul>\n
How to update Windows safely<\/h2>\n
The safest way to update Windows is through the built-in update feature. Open Start<\/strong>, go to Settings > Windows Update<\/strong>, and click \u201cCheck for updates.\u201d This should always be your first port of call.<\/p>\n<\/figure>\nMicrosoft does offer standalone update packages through the Microsoft Update Catalog (catalog.update.microsoft.com<\/code>), but this is the only legitimate source for manual downloads. Any other website offering a Windows update as a file should be treated as suspicious.<\/p>\nBe wary of pages that mimic Microsoft Support or Windows Update. These can look convincing, but the URL is what matters. Legitimate Microsoft pages are only served from domains ending in microsoft.com<\/strong>. A domain like microsoft-update[.]support<\/code> may look plausible, but it is not connected to Microsoft.<\/p>\nIf you receive an email, text, or notification urging you to install an urgent update, don\u2019t click the link. Instead, open Settings > Windows Update<\/strong> and check directly.<\/p>\nFinally, consider enabling automatic updates. This removes the need to download updates manually and reduces the chance of being tricked into installing a fake one.<\/p>\n
Indicators of Compromise (IOCs)<\/strong><\/h2>\nFile Hashes (SHA-256)<\/strong><\/p>\n