Fake MAS Windows activation domain used to spread PowerShell ...
2 days ago · A typosquatted domain impersonating the Microsoft Activation Scripts (MAS) tool was used to distribute malicious PowerShell scripts that infect Windows systems with the 'Cosmali Loader'.
Warning: Fake Domains Impersonating MAS Used to Trick Users ...
1 day ago · 549/68 Friday, December 26, 2025 A cyberattack campaign has been detected using typosquatting, in which attackers deliberately register look-alike domains with misspellings to deceive …
The “D” is for Danger: How a Tiny Typo in MAS Activation ...
1 day ago · That fake script does, in fact, activate the system (MAS itself is open source), but at the same time it silently installs malicious software. Because the MAS activation command must be run …
Typosquatted Windows Activator Domain Distributes Malicious ...
1 day ago · A fraudulent domain masquerading as the popular Microsoft Activation Scripts (MAS) tool is being used to infect users with a malicious PowerShell-based loader. The attackers registered the …
Fake Windows activation domain infects users with Cosmali ...
Users have discovered a fake domain posing as the MAS utility (Microsoft Activation Scripts) from the Massgrave project. The domain was used to distribute malicious PowerShell scripts that infected …
Fake Windows activation domains used to spread PowerShell ...
1 day ago · typosquatting using names that are very similar to the domains used for activation in Microsoft Activation Scripts (MAS), an open-source tool that can activate licenses for Windows and …
Fake MAS Windows Activation Domain Spreads PowerShell Malware
2 days ago · This article details a recent malware campaign targeting users of the Microsoft Activation Scripts (MAS) project, an open-source tool for activating Windows and Office. Here’s a …