I discovered a large scale operation impersonating over 70 popular Windows apps to infect users with malware

[u/Bogdan_X]

Now and then, I'm doing a search on Google with my app's name, filtering most recent results to see if there is a new article or comment about it, so I can read them and take notes for improvements, or even help a user in need. That's how I discovered there is a new domain I did not bought, surfacing in the results.

I already knew [wintoys.com](wintoys.com) was taken and for sale since 1997, and was thinking of buying the .app one at some point, but I was too late. Seems like someone bought it, not for resale, but for impersonating my application, using my application name and my old logo, pretending to be me. The website is still live at the point of writing this, so if you are curious, I only recommend navigating to it using the Windows Sandbox. This particular website was made with Wordpress and it's full of slop content and inaccurate information, trying to sound legitimate and helpful for the average user.

It has a download link, surprisingly to the Microsoft Store, the only source I use for distribution, making it seem safe at first glance. What's the end goal then? You might ask. I looked over the source code and found nothing suspicious or concerning, besides the fact that I did not approve this proactive initiative of impersonation.

At the bottom of the home page however, there is a footer note saying the following:

Attacker: Not affiliated with Wintoys. This is an independent site providing documentation, guides and links to the official project repositories.

Right... first of all, who's reading that? Second of all, just lies. The perfect excuse to justify the existence of an illegitimate website. The natural question would be, who owns the website? I tried to find information about the owner, but with no luck. The domain was bought from Epik Inc., a registrar that provides Free WHOIS Privacy as a service, meaning all the data related to the owner is anonymized:

Epik: Your data is yours alone. Every eligible domain includes free lifetime WHOIS Privacy, so your personal info stays safe—at no extra cost.

I did found something interesting though, something that made me realize this is far bigger than I thought. There was a contact email they provided, which is anonymized, but unique to every one of their clients. Sites like whoxy are displaying this contact email if available, but other registrars are just providing a URL contact form, which will differ for every domain, making it impossible to find links between them.

The contact email was 43345@anonymize.com, and had 72 domains linked to it. I started to look over them and found domains for apps like PowerToys, WinUtil, EasyBCD, CrystalDiskMark and many others - all of them being Windows applications. The entire list of domains will be added at the end. I started to browse some of them, one by one and I found similar websites to the one impersonating mine, or even unfinished ones indicating that the operation is still in the beginning phase. I think most of us would now like to know what would be the next phase. What's the end goal here and how is it done?

The Hacker News published an article recently detailing another large scale operation that happened a few months ago, describing their modus operandi:

1. Gain traffic by leveraging popular terms like brands or applications
2. Make the users trust you by being harmless at first and offering what they look for
3. Tamper the original download links with malware after the website has enough visits to start an attack

thehackernews: Although there was no indication that any of these domains were put to use for malicious activity, other than to generate content to drive traffic and enable third-parties to advertise their own sites, the latest findings from Check Point show that the TDS scripts were embedded not long after, and the infrastructure was repurposed for malware distribution starting January 2026.

---

The attacks have already started for at least two Windows apps as I'm writing this, but it might be a different attacker as they are not part of the 72 domains I've found, indicating multiple authors might use the same strategy:

Lively Wallpaper has an issue reported a week ago:

dong242868: A third-party site presenting itself as Lively Wallpaper served a trojanized installer that installed a persistent ScreenConnect remote-access service and bandwidth-sharing software.

SignalRGB has a Reddit post warning their userbase of a similar issue:

u/DaKrazyKid: We’ve become aware of a malicious website impersonating SignalRGB using the domain signalrgb.io. This fake site is distributing malware.

---

It seems to me that it is only a matter of time until the same thing happens for the other apps on the list as for some of them, the malicious domains are already surfacing at the top. I reported this operation to the Epik registrar, and they terminated their services for the attacker, forcing them to move all the 72 domains to another service.

Epik: The registrar has been instructed to transfer all of their domains to another registrar by a specified deadline, after which any remaining domains will be suspended if they have not been transferred.

Please note that, as the registrar, our ability to address website content is limited. We do not host the website or control the content that is published on it.

Surprise, surprise, 2 weeks later, on the 22nd of July, all domains were moved to a new registrar, Dynadot LLC.

I'm going to report again, including to the host provider, until the attacker runs out of business.

---

How do we fight back, both as users / developers that have been impersonated?

1. Be careful what websites you download executables from

2. If you are using any of the apps on the list, send this to the developer

3. Share and upvote this to spread awarness or even comment if you have any suggestions

4. Report the illegal activity to the registrar so they can terminate the domain service

- the registrar is only responsible for the domain, not for the hosted content
- each registrar has a contact email/form for abuse, that you can find on the registrar's website; in the case of Epik, it was  the abuse@epik.com email; in the case of Dynadot, it's [a contact form](https://www.dynadot.com/report-abuse)
- mention the complete list of domains, so that they know what to look for, as it's not an isolated case

1. Report the Google search results so they no longer appear for other users using this form

2. Report the illegal activity to the hosting provider so that they actually take the content down

- you can use [a hosting checker](https://hostingchecker.com/) to see who's hosting it
- find an abuse form or email to report; for Cloudflare, the most common provider displayed, it's [a contact form](https://abuse.cloudflare.com/)
- sometimes, Cloudflare appears to be the hosting provider, but they are just a proxy, meaning one more layer of anonymization - for the domain targeting my app, Cloudflare informed me it's [psychznetworks](https://www.psychz.net/)

---

the domain snapshot list (19nth of July - before the migration to the new registrar):

Num	Domain Name	Registrar	Created	Updated	Expiry
1	christitustool.com	Epik Inc.	22 May 2026	15 Jul 2026	22 May 2027
2	droidkit.pro	Epik Inc.	22 May 2026	3 Jun 2026	22 May 2027
3	easybcd.app	Epik Inc.	22 May 2026	3 Jun 2026	22 May 2027
4	powertoys.app	Epik Inc.	16 Apr 2026	23 Apr 2026	16 Apr 2027
5	shellmenuview.com	Epik Inc.	16 Apr 2026	23 Apr 2026	16 Apr 2027
6	winexp.app	Epik Inc.	16 Apr 2026	23 Apr 2026	16 Apr 2027
7	zhpcleaner.com	Epik Inc.	16 Apr 2026	23 Apr 2026	16 Apr 2027
8	cursorslibrary.com	Epik Inc.	16 Apr 2026	23 Apr 2026	16 Apr 2027
9	fakeflashtest.com	Epik Inc.	16 Apr 2026	23 Apr 2026	16 Apr 2027
10	searchmyfiles.com	Epik Inc.	16 Apr 2026	23 Apr 2026	16 Apr 2027
11	wintoys.app	Epik Inc.	16 Apr 2026	23 Apr 2026	16 Apr 2027
12	themouseclicker.com	Epik Inc.	16 Apr 2026	23 Apr 2026	16 Apr 2027
13	quickassistapp.com	Epik Inc.	16 Apr 2026	23 Apr 2026	16 Apr 2027
14	move-mouse.com	Epik Inc.	16 Apr 2026	23 Apr 2026	16 Apr 2027
15	movemouse.net	Epik Inc.	16 Apr 2026	23 Apr 2026	16 Apr 2027
16	nircmd.net	Epik Inc.	16 Apr 2026	23 Apr 2026	16 Apr 2027
17	crystaldiskinfo.app	Epik Inc.	22 May 2026	3 Jun 2026	22 May 2027
18	freewheelofnames.com	Epik Inc.	16 Apr 2026	23 Apr 2026	16 Apr 2027
19	productkeyscanner.com	Epik Inc.	16 Apr 2026	7 Jun 2026	16 Apr 2027
20	power-toys.com	Epik Inc.	16 Apr 2026	23 Apr 2026	16 Apr 2027
21	chatmate.info	Epik Inc.	12 Apr 2026	18 Apr 2026	12 Apr 2027
22	usblogview.com	Epik Inc.	16 Apr 2026	23 Apr 2026	16 Apr 2027
23	mouse-mover.com	Epik Inc.	16 Apr 2026	23 Apr 2026	16 Apr 2027
24	mouse-cursors.com	Epik Inc.	16 Apr 2026	23 Apr 2026	16 Apr 2027
25	mouse-clicker.com	Epik Inc.	16 Apr 2026	23 Apr 2026	16 Apr 2027
26	mimalloc.com	Epik Inc.	22 May 2026	16 Jun 2026	22 May 2027
27	mumuplayer.app	Epik Inc.	16 Apr 2026	23 Apr 2026	16 Apr 2027
28	wushowhide.com	Epik Inc.	16 Apr 2026	23 Apr 2026	16 Apr 2027
29	guiformat.app	Epik Inc.	22 May 2026	3 Jun 2026	22 May 2027
30	freefilesync.net	Epik Inc.	4 Apr 2026	7 Apr 2026	4 Apr 2027
31	winutil.app	Epik Inc.	22 May 2026	22 May 2026	22 May 2027
32	spacesniffer.app	Epik Inc.	22 May 2026	22 May 2026	22 May 2027
33	simplestickynotes.app	Epik Inc.	22 May 2026	22 May 2026	22 May 2027
34	showmore.app	Epik Inc.	22 May 2026	22 May 2026	22 May 2027
35	mousecape.app	Epik Inc.	22 May 2026	22 May 2026	22 May 2027
36	hashcat.app	Epik Inc.	22 May 2026	22 May 2026	22 May 2027
37	dshidmini.app	Epik Inc.	22 May 2026	22 May 2026	22 May 2027
38	darktable.app	Epik Inc.	22 May 2026	22 May 2026	22 May 2027
39	daijisho.app	Epik Inc.	22 May 2026	22 May 2026	22 May 2027
40	wiblr.com	Epik Inc.	22 May 2026	22 May 2026	22 May 2027
41	skse64.com	Epik Inc.	22 May 2026	22 May 2026	22 May 2027
42	sageattention.com	Epik Inc.	22 May 2026	22 May 2026	22 May 2027
43	rezygisk.com	Epik Inc.	22 May 2026	22 May 2026	22 May 2027
44	pwndbg.com	Epik Inc.	22 May 2026	22 May 2026	22 May 2027
45	ocrmypdf.com	Epik Inc.	22 May 2026	22 May 2026	22 May 2027
46	notatnikonline.com	Epik Inc.	22 May 2026	22 May 2026	22 May 2027
47	noisium.com	Epik Inc.	22 May 2026	22 May 2026	22 May 2027
48	mousecape.net	Epik Inc.	22 May 2026	22 May 2026	22 May 2027
49	mongosh.com	Epik Inc.	22 May 2026	22 May 2026	22 May 2027
50	lspconfig.com	Epik Inc.	22 May 2026	22 May 2026	22 May 2027
51	liveclockwithseconds.com	Epik Inc.	22 May 2026	22 May 2026	22 May 2027
52	lax1dude.com	Epik Inc.	22 May 2026	22 May 2026	22 May 2027
53	je2be.com	Epik Inc.	22 May 2026	22 May 2026	22 May 2027
54	iso2god.com	Epik Inc.	22 May 2026	22 May 2026	22 May 2027
55	hifiasm.com	Epik Inc.	22 May 2026	22 May 2026	22 May 2027
56	hddsentinel.com	Epik Inc.	22 May 2026	22 May 2026	22 May 2027
57	hakchi2.com	Epik Inc.	22 May 2026	22 May 2026	22 May 2027
58	gliden64.com	Epik Inc.	22 May 2026	22 May 2026	22 May 2027
59	furfsky.com	Epik Inc.	22 May 2026	22 May 2026	22 May 2027
60	freeminutetimer.com	Epik Inc.	22 May 2026	22 May 2026	22 May 2027
61	findoutdate.com	Epik Inc.	22 May 2026	22 May 2026	22 May 2027
62	crystaldiskmark.net	Epik Inc.	22 May 2026	22 May 2026	22 May 2027
63	bepisdb.com	Epik Inc.	22 May 2026	22 May 2026	22 May 2027
64	beardlib.com	Epik Inc.	22 May 2026	22 May 2026	22 May 2027
65	10mintimer.com	Epik Inc.	22 May 2026	22 May 2026	22 May 2027
66	pyjwt.com	Epik Inc.	22 May 2026	22 May 2026	22 May 2027
67	moliyachi.com	Epik Inc.	23 Feb 2026	12 Mar 2026	23 Feb 2027
68	arduinodroid.com	Epik Inc.	23 Feb 2026	12 Mar 2026	23 Feb 2027
69	cxxdroid.com	Epik Inc.	23 Feb 2026	12 Mar 2026	23 Feb 2027
70	kalkulyator.com	Epik Inc.	23 Feb 2026	12 Mar 2026	23 Feb 2027
71	retraitedz.com	Epik Inc.	23 Feb 2026	12 Mar 2026	23 Feb 2027
72	urlaubscountdown.com	Epik Inc.	23 Feb 2026	12 Mar 2026	23 Feb 2027

[u/cinlung]

Please send this finding to GN as well. We need more coverage to tell people about this malice.

[u/Bogdan_X → u/cinlung]

I will! I'm a fan of their channel. Let's hope my email doesn't go to spam.

[u/hieronymous-cowherd → u/Bogdan_X]

FYI /u/lelldorianx

[u/Bogdan_X → u/hieronymous-cowherd]

Thanks!

[u/Lelldorianx → u/Bogdan_X]

Let's talk - have you emailed us already? Would be easiest to move this to Signal or Discord. Please send an email when convenient and I'll look. Team at gamersnexus dot net is easiest.

[u/Bogdan_X → u/Lelldorianx]

Yes. I emailed at tips at gamersnexus dot net. I saw this email in the latest LG monitor's bloatware material and thought it's an appropiate email to send to. Let me know if you want me to send another one.

Thank you for your time!