Fake Software Downloads: How Cybercriminals Are Using Counterfeit Installers to Compromise Windows Systems

A Nigerian cybersecurity advisory has warned of a malware campaign involving counterfeit software websites and malicious installers. The incident highlights why downloading familiar applications from unverified sources can expose computers and business networks to serious risks.

Downloading software has become a routine part of using computers. Whether installing a browser, productivity application, PDF tool or device utility, users regularly search online for applications that meet their needs.

However, not every website offering a familiar application is legitimate.

Cybercriminals increasingly exploit this behaviour by creating fraudulent software download pages that imitate genuine vendors. Visitors may believe they are downloading a legitimate application, only to install malware capable of compromising their devices.

On 6 October 2026, the Nigeria Computer Emergency Response Team (ngCERT) issued a high-risk security advisory warning organisations about a campaign involving counterfeit software websites and fake Windows installers linked to the Silver Fox threat actor, also known as Yinhu.

The campaign demonstrates how an ordinary software download can become an entry point for a much more serious security incident.

How the fake software download campaign works

According to ngCERT, the attackers create fraudulent websites designed to resemble legitimate software vendors and distribute malicious ZIP archives or installers disguised as genuine applications.

The websites target users searching for popular software. Applications impersonated in the campaign include Microsoft Edge, Kaspersky, Razer, Sejda PDF, DiskGenius, Baidu Netdisk and other familiar products.

A user may encounter one of these websites while searching for an application, click what appears to be a legitimate download option and retrieve a malicious archive or installer.

The downloaded file may look like an ordinary software installation package. However, executing it can initiate a sequence of malicious activities without the user's full understanding of what is taking place.

This is particularly concerning because the initial action may appear completely routine.

What happens after a malicious installer is executed?

The ngCERT advisory describes an attack sequence involving several stages, including execution, persistence, privilege escalation, security evasion and communication with attacker-controlled infrastructure.

Some of the observed activities include:

1. Establishing persistence

The malware can create scheduled tasks and use other mechanisms to maintain access to the compromised computer, potentially allowing malicious activity to continue beyond the initial execution.

2. Obtaining elevated privileges

The campaign has been observed using techniques that allow malicious processes to obtain higher system privileges, potentially giving attackers greater control over the affected device.

3. Weakening security protections

The malicious activity includes attempts to modify Microsoft Defender exclusions and interfere with Windows security and update mechanisms. This can reduce the effectiveness of existing protective controls.

4. Interfering with recovery mechanisms

The advisory reports attempts to delete Volume Shadow Copies, which are used by Windows for certain file recovery and system restoration functions.

This is significant because weakening recovery options can make it more difficult to restore affected systems following an incident.

5. Communicating with attacker-controlled infrastructure

Once established, the malware can communicate with external infrastructure controlled by the attackers. This can support further malicious activity and potentially facilitate wider compromise.

The advisory also identifies observed attempts at SMB-based lateral movement, meaning an initially compromised workstation could potentially become a pathway to other systems within an organisation.

Why businesses should take this threat seriously

The consequences of a malicious software installation can extend beyond one employee's computer.

In an organisation where users have unrestricted software installation privileges, a single compromised endpoint may create opportunities for attackers to access additional systems, interfere with security controls or disrupt business operations.

This is especially concerning for businesses that depend on Windows devices for financial operations, communication, customer information, administration and access to shared resources.

The risk is not limited to large enterprises. Small and medium-sized businesses may also be exposed, particularly where software downloads are not centrally controlled and endpoint security is not consistently monitored.

A familiar application name should never be treated as proof that a download is safe.

Five ways to reduce the risk of malicious software downloads

Preventing fake software installations requires a combination of user awareness, administrative controls and effective endpoint protection.

1. Download software from official sources

Whenever possible, obtain applications directly from the software developer's official website or an approved organisational software repository.

Avoid download links from unfamiliar websites, unsolicited messages, suspicious advertisements and unofficial file-sharing platforms.

2. Restrict unauthorised software installation

Organisations should establish clear policies governing which applications employees can install.

Where practical, limit installation privileges and implement application allowlisting so that only approved software can run.

3. Keep endpoint security enabled and updated

Ensure that endpoint protection is installed, active and receiving regular updates. Security controls should not be disabled to accommodate an unfamiliar installer or an unexpected installation prompt.

4. Monitor unusual system activity

IT and security teams should investigate unexpected changes to security settings, suspicious scheduled tasks, unusual PowerShell activity and unauthorised modifications to Windows recovery or update mechanisms.

5. Maintain reliable backups

Keep important business information backed up using an appropriate backup strategy. Backups should be protected against unauthorised access and tested periodically to confirm that data can be restored when necessary.

Backups are particularly important because some malware campaigns attempt to interfere with recovery mechanisms.

How can endpoint protection help?

Endpoint protection plays an important role in identifying and preventing malicious activity on computers and other connected devices.

ESET's multilayered endpoint protection technology is designed to detect and block different categories of malware and suspicious activity. Its approach combines multiple protective technologies to address threats at different stages of an attack.

For organisations, ESET PROTECT provides a cloud-based management console through which security administrators can manage supported ESET business security products and gain visibility into their protected environments.

The ESET PROTECT Entry offering provides business endpoint protection and centralised cloud management. Additional capabilities vary by subscription tier, so organisations should evaluate their specific security requirements before selecting a solution.

It is important to understand that endpoint protection is not a replacement for secure software procurement, access controls, patch management or backups. Nor should any single security product be assumed to prevent every new or evolving threat.

The strongest approach combines technology with responsible software installation practices and ongoing security oversight.

A familiar download is not always a safe download

The fake software installer campaign reported by ngCERT highlights a recurring challenge in cybersecurity: attackers do not always need users to visit obviously malicious websites or open suspicious email attachments.

Sometimes, they only need users to trust a familiar application name and download it from the wrong source.

For individuals, the lesson is simple: verify the source before installing software.

For organisations, the responsibility goes further. Establish approved software repositories, restrict unnecessary installation privileges, maintain endpoint protection and monitor for unusual system behaviour.

As cyber threats continue to evolve, the security of an organisation's devices depends not only on the applications it uses, but also on how those applications are obtained, installed and managed.

Protecting your digital environment starts before the download.