Typosquatted Domain Used to Distribute Cosmali Loader Malware

A recent incident involved a typosquatted domain, ‘get.activate[.]win,’ which closely resembles the legitimate Microsoft Activation Scripts (MAS) tool domain. Users mistyped the correct domain, leading to the distribution of malicious PowerShell scripts that infect Windows systems with the Cosmali Loader malware. Reports surfaced on Reddit from multiple MAS users who received alarming notifications about the infection.

The Cosmali Loader malware, identified by security researcher RussianPanda, is known to deliver cryptomining utilities and the XWorm remote access trojan (RAT). The malware’s control panel is insecure, allowing unauthorized access to infected systems. Users are advised to check their Task Manager for unusual PowerShell processes as an indication of infection.

The maintainers of the MAS project, which automates the activation of Microsoft products, have warned users about this campaign. They emphasize the importance of double-checking commands before execution to avoid falling victim to such attacks. Microsoft views MAS as a piracy tool, as it activates products without proper licenses.

Understanding the Risks of Typosquatting

This incident underscores the risks associated with typosquatting, where attackers create look-alike domains to exploit user errors. The difference between the legitimate and malicious domains was just one character, making it easy for users to make a mistake. This tactic is not new; unofficial Windows activators have been previously linked to malware distribution.

Users should be cautious when using unofficial tools for software activation, as they may expose their systems to malware. The incident serves as a reminder to always verify URLs and commands before executing them, especially when dealing with potentially harmful scripts.

Practical Implications for Users

Everyday users and organizations must remain vigilant against such threats. It is crucial to avoid executing remote code unless fully understood and to test commands in a safe environment. Additionally, users should refrain from retyping commands to minimize the risk of inadvertently accessing dangerous payloads from typosquatted domains.

Overall, this incident highlights the ongoing cybersecurity challenges posed by unofficial software tools and the importance of maintaining a cautious approach to software activation and command execution.