A newly uncovered network of fake websites is impersonating more than 70 popular Windows applications—including Microsoft’s own PowerToys, SignalRGB, and CrystalDiskMark—to distribute malware through search-engine results. First reported by Digital Trends on July 28, 2026, the campaign uses sophisticated bait-and-switch tactics: sites appear legitimate, sometimes even linking to official stores, before selectively redirecting some visitors to malicious installers.

The anatomy of a bait-and-switch distribution network

At first glance, these counterfeit pages look polished. Many clone official branding, replicate screenshots, and feature accurate product descriptions. A site for Wintoys, a customization utility, even used the application’s older logo and AI-generated filler text. Its download button initially pointed to the real Microsoft Store listing—a clever bit of trust-building that makes the page seem harmless on first visit.

But that appearance of safety is the trap. Researchers at Check Point Research discovered that the pages don’t serve the same download to every visitor. Instead, they rely on a Traffic Distribution System (TDS): a decision engine that checks conditions like geographic location, browser details, VPN usage, and whether the visitor behaves like a security scanner. Depending on the assessment, the same download click can lead to the legitimate application, a harmless redirect, or a malicious installer.

“A crude impersonation page is relatively easy to spot,” notes the Check Point analysis. “This operation is more complicated because the visible website is only the first stage.” The researchers observed downstream routing that delivered information stealers like RemusStealer, AnimateClipper, and the SessionGate framework. RemusStealer alone can harvest data from more than 20 browsers, plus extensions and applications tied to password managers, two-factor authentication, and cryptocurrency wallets.

Apps in the crosshairs

The scale is significant. The Wintoys developer, after tracing a shared anonymized contact address, linked the fake wintoys.app to 72 other domains targeting Windows software brands. The list includes utilities that millions of users download daily:

  • Microsoft PowerToys
  • CrystalDiskMark
  • EasyBCD
  • WinUtil
  • Lively Wallpaper
  • SignalRGB

Lively Wallpaper’s case is especially instructive. A fake site reportedly delivered a trojanized installer that included a malicious DLL, a persistent ScreenConnect remote-access service, and bandwidth-sharing software—all while the wallpaper app appeared to work normally. SignalRGB, an RGB lighting utility, publicly warned users about signalrgb.io and signal-rgb.net, noting that one installer could deploy a legitimate ScreenConnect client disguised as a Visual C++ Redistributable.

This is the bait-and-switch in action: the installer you expected works, so you assume the source was trustworthy. Meanwhile, a silent compromise unfolds in the background.

What this means for you

The campaign fundamentally changes the risk calculus for downloading freeware on Windows. For years, power users felt safe as long as an installer looked legitimate and the site had a padlock icon. Those visual cues are now cheap to replicate.

For home users and enthusiasts

If you’ve ever typed “PowerToys download” or “CrystalDiskMark Windows 11” into Google and clicked the top result, you’re in the target demographic. The danger isn’t limited to people chasing cracked software or dubious “free premium” offers. It reaches anyone seeking legitimate, widely used applications through normal search behavior. The stolen information can include:

  • Saved browser passwords (email, shopping, work accounts)
  • Session cookies that let attackers hijack active logins
  • Password-manager vault data
  • Cryptocurrency wallet credentials
  • Two-factor authentication tokens

Once an attacker has remote access—via a tool like ScreenConnect, concealed in a fake installer—they can return to the machine even after the initial infection window closes.

For IT administrators

The threat to organizations is two-fold. First, an employee searching for a disk benchmark or desktop customizer could bring the trojan into a corporate network. Second, the TDS infrastructure can selectively target users, making it harder to detect with automated crawlers. A site that looks clean during a security scan might still serve malware to a normal user in a specific location.

Admins should reinforce that the Microsoft Store, official domains, and managed deployment tools are the only approved download paths. Winget, Microsoft’s package manager, can also be locked down to verified sources.

How we got here

Search-engine impersonation is not new. The FBI warned years ago that cybercriminals buy ads and create lookalike domains to impersonate brands. In software-download scenarios, the agency noted that malicious pages may resemble the genuine publisher’s site and offer files named after the program a user intended to download.

What’s evolved is the sophistication of the distribution pipeline. In 2026, Malwarebytes analyzed a separate campaign that used fake Windows 11 download pages promoted through Facebook ads. Those sites checked for data-center IPs and analysis environments, redirecting suspected researchers elsewhere while serving malicious installers to likely consumer targets. The delivery channel was different, but the operational principle was identical: trusted branding, targeted routing, and selective payload delivery.

The new wave extends that model to dozens of independently developed applications, many of which rely on GitHub-hosted releases and fragmented distribution channels. A cloned site can look more authoritative than the real project page, especially when it uses familiar logos, screenshots, and how-to guides.

What to do now: A practical download hygiene checklist

The response does not require abandoning useful freeware or open-source software. It requires changing the order of operations: verify the publisher first, then download.

1. Prefer first-party distribution paths

For Windows utilities, stick to these sources, in order of preference:

  • Microsoft Store – if the developer publishes there. The Store requires publisher code signing and certification checks, and it reduces the chance of a third-party page handing you an arbitrary executable.
  • Official domain – type it directly or use a bookmark; don’t rely on search.
  • Verified GitHub repository – look for the official organization or developer account.
  • Winget – after confirming the package identity and source.

Logos are trivial to copy. Before downloading, check the address bar for:

  • Misspellings, extra hyphens, added words
  • Unusual top-level domains like .app, .io, .net, or .org when the authentic domain uses .com
  • Brand names inserted before or after unrelated words

3. Verify an installer’s digital signature

For traditional .exe and .msi files, this 30-second check can prevent a mistake:

  1. Right-click the downloaded installer.
  2. Select Properties.
  3. Open the Digital Signatures tab.
  4. Confirm a signature is present and select it.
  5. Verify the signer name matches the expected publisher (e.g., Microsoft Corporation, not an unknown entity).

This is not absolute proof—certificates can be stolen—but an unsigned installer from an unknown signer should stop the installation.

4. Treat download aggregators as a last resort

Sites that claim to be “official download” portals or aggregators are unnecessary for mainstream utilities. If the official source is hard to find, pause and search for the developer’s social accounts, GitHub organization, or Store publisher identity to confirm the correct domain.

5. If you already ran a suspicious installer

If you downloaded but did not open the file: delete it and run a scan with Windows Security.

If you executed the installer, assume the system may be compromised and take these steps immediately:

  • Disconnect from sensitive activity – avoid signing into email, banking, or crypto accounts on that PC until it’s clean.
  • Run a full scan – open Windows Security > Virus & threat protection > Scan options > Full scan.
  • Use Microsoft Defender Offline – this restarts the PC and scans before Windows loads, making it harder for malware to hide.
  • Review Protection history for detections and quarantined files.
  • Change passwords from a clean device – start with email accounts and password managers.
  • Revoke active sessions for critical services.
  • Check for unfamiliar remote-access tools or services in installed programs and startup entries.
  • Consider professional remediation or a clean reinstall if evidence of credential theft or persistent remote access exists.

Outlook

The campaign reveals a threat landscape where the most dangerous malware doesn’t announce itself with a broken installer—it looks like the tool you wanted, behaves like the tool you wanted, and quietly steals your credentials in the background. The same infrastructure that delivered your legitimate download last week can serve a stealer today.

For Windows users, the lesson is blunt but durable: the app name is not the publisher, and a high search ranking is not a trust signal. Verification must happen before the download, every time. In an era where a wallpaper utility can be a Trojan horse, that’s not excessive caution—it’s basic hygiene.