security: Counterfeit installers to system compromise: Tracking a deceptive software download campaign
Microsoft Security Blog
2026-09-01
Microsoft describes an active malware campaign that uses fake software download pages and repackaged installer archives to impersonate legitimate vendors. The post includes observed tactics, Defender XDR detections, indicators of compromise, and mitigation guidance.