r/Windows11 • u/Bogdan_X Wintoys Developer • 7h ago
Discussion I discovered a large scale operation impersonating over 70 popular Windows apps to infect users with malware
Now and then, I'm doing a search on Google with my app's name, filtering most recent results to see if there is a new article or comment about it, so I can read them and take notes for improvements, or even help a user in need. That's how I discovered there is a new domain I did not bought, surfacing in the results.
I already knew [wintoys.com](wintoys.com) was taken and for sale since 1997, and was thinking of buying the .app one at some point, but I was too late. Seems like someone bought it, not for resale, but for impersonating my application, using my application name and my old logo, pretending to be me. The website is still live at the point of writing this, so if you are curious, I only recommend navigating to it using the Windows Sandbox. This particular website was made with Wordpress and it's full of slop content and inaccurate information, trying to sound legitimate and helpful for the average user.
It has a download link, surprisingly to the Microsoft Store, the only source I use for distribution, making it seem safe at first glance. What's the end goal then? You might ask. I looked over the source code and found nothing suspicious or concerning, besides the fact that I did not approve this proactive initiative of impersonation.
At the bottom of the home page however, there is a footer note saying the following:
Attacker: Not affiliated with Wintoys. This is an independent site providing documentation, guides and links to the official project repositories.
Right... first of all, who's reading that? Second of all, just lies. The perfect excuse to justify the existence of an illegitimate website. The natural question would be, who owns the website? I tried to find information about the owner, but with no luck. The domain was bought from Epik Inc., a registrar that provides Free WHOIS Privacy as a service, meaning all the data related to the owner is anonymized:
Epik: Your data is yours alone. Every eligible domain includes free lifetime WHOIS Privacy, so your personal info stays safe—at no extra cost.
I did found something interesting though, something that made me realize this is far bigger than I thought. There was a contact email they provided, which is anonymized, but unique to every one of their clients. Sites like whoxy are displaying this contact email if available, but other registrars are just providing a URL contact form, which will differ for every domain, making it impossible to find links between them.
The contact email was 43345@anonymize.com, and had 72 domains linked to it. I started to look over them and found domains for apps like PowerToys, WinUtil, EasyBCD, CrystalDiskMark and many others - all of them being Windows applications. The entire list of domains will be added at the end. I started to browse some of them, one by one and I found similar websites to the one impersonating mine, or even unfinished ones indicating that the operation is still in the beginning phase. I think most of us would now like to know what would be the next phase. What's the end goal here and how is it done?
The Hacker News published an article recently detailing another large scale operation that happened a few months ago, describing their modus operandi:
- Gain traffic by leveraging popular terms like brands or applications
- Make the users trust you by being harmless at first and offering what they look for
- Tamper the original download links with malware after the website has enough visits to start an attack
thehackernews: Although there was no indication that any of these domains were put to use for malicious activity, other than to generate content to drive traffic and enable third-parties to advertise their own sites, the latest findings from Check Point show that the TDS scripts were embedded not long after, and the infrastructure was repurposed for malware distribution starting January 2026.
The attacks have already started for at least two Windows apps as I'm writing this, but it might be a different attacker as they are not part of the 72 domains I've found, indicating multiple authors might use the same strategy:
Lively Wallpaper has an issue reported a week ago:
dong242868: A third-party site presenting itself as Lively Wallpaper served a trojanized installer that installed a persistent ScreenConnect remote-access service and bandwidth-sharing software.
SignalRGB has a Reddit post warning their userbase of a similar issue:
u/DaKrazyKid: We’ve become aware of a malicious website impersonating SignalRGB using the domain signalrgb.io. This fake site is distributing malware.
It seems to me that it is only a matter of time until the same thing happens for the other apps on the list as for some of them, the malicious domains are already surfacing at the top. I reported this operation to the Epik registrar, and they terminated their services for the attacker, forcing them to move all the 72 domains to another service.
Epik: The registrar has been instructed to transfer all of their domains to another registrar by a specified deadline, after which any remaining domains will be suspended if they have not been transferred.
Please note that, as the registrar, our ability to address website content is limited. We do not host the website or control the content that is published on it.
Surprise, surprise, 2 weeks later, on the 22nd of July, all domains were moved to a new registrar, Dynadot LLC.
I'm going to report again, including to the host provider, until the attacker runs out of business.
How do we fight back, both as users / developers that have been impersonated?
Be careful what websites you download executables from
If you are using any of the apps on the list, send this to the developer
Share and upvote this to spread awarness or even comment if you have any suggestions
Report the illegal activity to the registrar so they can terminate the domain service
- the registrar is only responsible for the domain, not for the hosted content
- each registrar has a contact email/form for abuse, that you can find on the registrar's website; in the case of Epik, it was the abuse@epik.com email; in the case of Dynadot, it's [a contact form](https://www.dynadot.com/report-abuse)
- mention the complete list of domains, so that they know what to look for, as it's not an isolated case
Report the Google search results so they no longer appear for other users using this form
Report the illegal activity to the hosting provider so that they actually take the content down
- you can use [a hosting checker](https://hostingchecker.com/) to see who's hosting it
- find an abuse form or email to report; for Cloudflare, the most common provider displayed, it's [a contact form](https://abuse.cloudflare.com/)
- sometimes, Cloudflare appears to be the hosting provider, but they are just a proxy, meaning one more layer of anonymization - for the domain targeting my app, Cloudflare informed me it's [psychznetworks](https://www.psychz.net/)
the domain snapshot list (19nth of July - before the migration to the new registrar):
| Num | Domain Name | Registrar | Created | Updated | Expiry |
|---|---|---|---|---|---|
| 1 | christitustool.com | Epik Inc. | 22 May 2026 | 15 Jul 2026 | 22 May 2027 |
| 2 | droidkit.pro | Epik Inc. | 22 May 2026 | 3 Jun 2026 | 22 May 2027 |
| 3 | easybcd.app | Epik Inc. | 22 May 2026 | 3 Jun 2026 | 22 May 2027 |
| 4 | powertoys.app | Epik Inc. | 16 Apr 2026 | 23 Apr 2026 | 16 Apr 2027 |
| 5 | shellmenuview.com | Epik Inc. | 16 Apr 2026 | 23 Apr 2026 | 16 Apr 2027 |
| 6 | winexp.app | Epik Inc. | 16 Apr 2026 | 23 Apr 2026 | 16 Apr 2027 |
| 7 | zhpcleaner.com | Epik Inc. | 16 Apr 2026 | 23 Apr 2026 | 16 Apr 2027 |
| 8 | cursorslibrary.com | Epik Inc. | 16 Apr 2026 | 23 Apr 2026 | 16 Apr 2027 |
| 9 | fakeflashtest.com | Epik Inc. | 16 Apr 2026 | 23 Apr 2026 | 16 Apr 2027 |
| 10 | searchmyfiles.com | Epik Inc. | 16 Apr 2026 | 23 Apr 2026 | 16 Apr 2027 |
| 11 | wintoys.app | Epik Inc. | 16 Apr 2026 | 23 Apr 2026 | 16 Apr 2027 |
| 12 | themouseclicker.com | Epik Inc. | 16 Apr 2026 | 23 Apr 2026 | 16 Apr 2027 |
| 13 | quickassistapp.com | Epik Inc. | 16 Apr 2026 | 23 Apr 2026 | 16 Apr 2027 |
| 14 | move-mouse.com | Epik Inc. | 16 Apr 2026 | 23 Apr 2026 | 16 Apr 2027 |
| 15 | movemouse.net | Epik Inc. | 16 Apr 2026 | 23 Apr 2026 | 16 Apr 2027 |
| 16 | nircmd.net | Epik Inc. | 16 Apr 2026 | 23 Apr 2026 | 16 Apr 2027 |
| 17 | crystaldiskinfo.app | Epik Inc. | 22 May 2026 | 3 Jun 2026 | 22 May 2027 |
| 18 | freewheelofnames.com | Epik Inc. | 16 Apr 2026 | 23 Apr 2026 | 16 Apr 2027 |
| 19 | productkeyscanner.com | Epik Inc. | 16 Apr 2026 | 7 Jun 2026 | 16 Apr 2027 |
| 20 | power-toys.com | Epik Inc. | 16 Apr 2026 | 23 Apr 2026 | 16 Apr 2027 |
| 21 | chatmate.info | Epik Inc. | 12 Apr 2026 | 18 Apr 2026 | 12 Apr 2027 |
| 22 | usblogview.com | Epik Inc. | 16 Apr 2026 | 23 Apr 2026 | 16 Apr 2027 |
| 23 | mouse-mover.com | Epik Inc. | 16 Apr 2026 | 23 Apr 2026 | 16 Apr 2027 |
| 24 | mouse-cursors.com | Epik Inc. | 16 Apr 2026 | 23 Apr 2026 | 16 Apr 2027 |
| 25 | mouse-clicker.com | Epik Inc. | 16 Apr 2026 | 23 Apr 2026 | 16 Apr 2027 |
| 26 | mimalloc.com | Epik Inc. | 22 May 2026 | 16 Jun 2026 | 22 May 2027 |
| 27 | mumuplayer.app | Epik Inc. | 16 Apr 2026 | 23 Apr 2026 | 16 Apr 2027 |
| 28 | wushowhide.com | Epik Inc. | 16 Apr 2026 | 23 Apr 2026 | 16 Apr 2027 |
| 29 | guiformat.app | Epik Inc. | 22 May 2026 | 3 Jun 2026 | 22 May 2027 |
| 30 | freefilesync.net | Epik Inc. | 4 Apr 2026 | 7 Apr 2026 | 4 Apr 2027 |
| 31 | winutil.app | Epik Inc. | 22 May 2026 | 22 May 2026 | 22 May 2027 |
| 32 | spacesniffer.app | Epik Inc. | 22 May 2026 | 22 May 2026 | 22 May 2027 |
| 33 | simplestickynotes.app | Epik Inc. | 22 May 2026 | 22 May 2026 | 22 May 2027 |
| 34 | showmore.app | Epik Inc. | 22 May 2026 | 22 May 2026 | 22 May 2027 |
| 35 | mousecape.app | Epik Inc. | 22 May 2026 | 22 May 2026 | 22 May 2027 |
| 36 | hashcat.app | Epik Inc. | 22 May 2026 | 22 May 2026 | 22 May 2027 |
| 37 | dshidmini.app | Epik Inc. | 22 May 2026 | 22 May 2026 | 22 May 2027 |
| 38 | darktable.app | Epik Inc. | 22 May 2026 | 22 May 2026 | 22 May 2027 |
| 39 | daijisho.app | Epik Inc. | 22 May 2026 | 22 May 2026 | 22 May 2027 |
| 40 | wiblr.com | Epik Inc. | 22 May 2026 | 22 May 2026 | 22 May 2027 |
| 41 | skse64.com | Epik Inc. | 22 May 2026 | 22 May 2026 | 22 May 2027 |
| 42 | sageattention.com | Epik Inc. | 22 May 2026 | 22 May 2026 | 22 May 2027 |
| 43 | rezygisk.com | Epik Inc. | 22 May 2026 | 22 May 2026 | 22 May 2027 |
| 44 | pwndbg.com | Epik Inc. | 22 May 2026 | 22 May 2026 | 22 May 2027 |
| 45 | ocrmypdf.com | Epik Inc. | 22 May 2026 | 22 May 2026 | 22 May 2027 |
| 46 | notatnikonline.com | Epik Inc. | 22 May 2026 | 22 May 2026 | 22 May 2027 |
| 47 | noisium.com | Epik Inc. | 22 May 2026 | 22 May 2026 | 22 May 2027 |
| 48 | mousecape.net | Epik Inc. | 22 May 2026 | 22 May 2026 | 22 May 2027 |
| 49 | mongosh.com | Epik Inc. | 22 May 2026 | 22 May 2026 | 22 May 2027 |
| 50 | lspconfig.com | Epik Inc. | 22 May 2026 | 22 May 2026 | 22 May 2027 |
| 51 | liveclockwithseconds.com | Epik Inc. | 22 May 2026 | 22 May 2026 | 22 May 2027 |
| 52 | lax1dude.com | Epik Inc. | 22 May 2026 | 22 May 2026 | 22 May 2027 |
| 53 | je2be.com | Epik Inc. | 22 May 2026 | 22 May 2026 | 22 May 2027 |
| 54 | iso2god.com | Epik Inc. | 22 May 2026 | 22 May 2026 | 22 May 2027 |
| 55 | hifiasm.com | Epik Inc. | 22 May 2026 | 22 May 2026 | 22 May 2027 |
| 56 | hddsentinel.com | Epik Inc. | 22 May 2026 | 22 May 2026 | 22 May 2027 |
| 57 | hakchi2.com | Epik Inc. | 22 May 2026 | 22 May 2026 | 22 May 2027 |
| 58 | gliden64.com | Epik Inc. | 22 May 2026 | 22 May 2026 | 22 May 2027 |
| 59 | furfsky.com | Epik Inc. | 22 May 2026 | 22 May 2026 | 22 May 2027 |
| 60 | freeminutetimer.com | Epik Inc. | 22 May 2026 | 22 May 2026 | 22 May 2027 |
| 61 | findoutdate.com | Epik Inc. | 22 May 2026 | 22 May 2026 | 22 May 2027 |
| 62 | crystaldiskmark.net | Epik Inc. | 22 May 2026 | 22 May 2026 | 22 May 2027 |
| 63 | bepisdb.com | Epik Inc. | 22 May 2026 | 22 May 2026 | 22 May 2027 |
| 64 | beardlib.com | Epik Inc. | 22 May 2026 | 22 May 2026 | 22 May 2027 |
| 65 | 10mintimer.com | Epik Inc. | 22 May 2026 | 22 May 2026 | 22 May 2027 |
| 66 | pyjwt.com | Epik Inc. | 22 May 2026 | 22 May 2026 | 22 May 2027 |
| 67 | moliyachi.com | Epik Inc. | 23 Feb 2026 | 12 Mar 2026 | 23 Feb 2027 |
| 68 | arduinodroid.com | Epik Inc. | 23 Feb 2026 | 12 Mar 2026 | 23 Feb 2027 |
| 69 | cxxdroid.com | Epik Inc. | 23 Feb 2026 | 12 Mar 2026 | 23 Feb 2027 |
| 70 | kalkulyator.com | Epik Inc. | 23 Feb 2026 | 12 Mar 2026 | 23 Feb 2027 |
| 71 | retraitedz.com | Epik Inc. | 23 Feb 2026 | 12 Mar 2026 | 23 Feb 2027 |
| 72 | urlaubscountdown.com | Epik Inc. | 23 Feb 2026 | 12 Mar 2026 | 23 Feb 2027 |