Bleeping Computer

Fake MAS Windows activation domain used to spread PowerShell malware

A typosquatted domain impersonating the Microsoft Activation Scripts (MAS) tool was used to distribute malicious PowerShell scripts that infect Windows systems with the 'Cosmali Loader'.
livedoor ニュース

偽のWindowsアクティベーションドメインがPowerShellマルウェア拡散に ...

WindowsやMicrosoft Officeのライセンス認証ができるというオープンソースツール「Microsoft Activation Scripts(MAS)」で、アクティベーションに利用しているドメインにそっくりな名前を用いたタイポスクワッティングにより、悪意あるPowerShellスクリプトでマルウェアに ...
GIGAZINE

Fake Windows activation domains used to spread PowerShell malware

typosquatting using names that are very similar to the domains used for activation in Microsoft Activation Scripts (MAS), an open-source tool that can activate licenses for Windows and Microsoft ...
Neowin

Beware: This Windows key verifier tool is actually a deadly BitRAT that bypasses Defender

A new remote access trojan (RAT) or BitRAT has been found which is being distributed through fake Windows product license key activation tools. It is able to bypass detections by Windows Defender.