# Beware Fake Windows 11 Upgrade Installers Bringing RedLine Malware **URL:** \ **Category:** News & Articles\ **Tags:** hacking, operating-system\ **Created:** [February 13, 2022, 1:48pm UTC](https://onehack.st/t/beware-fake-windows-11-upgrade-installers-bringing-redline-malware/214464 "2022-02-13T13:48:09Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![Aina](https://onehack.st/user_avatar/onehack.st/aina/32/167469_2.png) [@Aina](https://onehack.st/u/Aina)\ **Post date:** [February 13, 2022, 1:48pm UTC](https://onehack.st/t/beware-fake-windows-11-upgrade-installers-bringing-redline-malware/214464/1 "2022-02-13T13:48:09Z")
[![](https://www.bleepstatic.com/content/hl-images/2022/02/09/Windows__11.jpg) ](https://www.bleepstatic.com/content/hl-images/2022/02/09/Windows__11.jpg) Slashdot reader [joshuark](https://tech.slashdot.org/~joshuark) writes:_Beware fake Windows 11 upgrades install RedLine malware, reports Bleeping Computer._ _“Threat actors have started [distributing fake Windows 11 upgrade installers to users of Windows 10](https://www.bleepingcomputer.com/news/security/fake-windows-11-upgrade-installers-infect-you-with-redline-malware/), tricking them into downloading and executing RedLine stealer malware.” Bleeping Computer advises, “…these dangerous sites are promoted via forum and social media posts or instant messages, so don’t trust anything but the official Windows upgrade system alerts.”_ _Bleeping Computer_ points out that hardware incompatibilities rule out upgrades for many Windows 10 users from official distribution channels — “something that malware operators see as an excellent opportunity for finding new victims.”_The timing of the attacks coincides with the moment that Microsoft announced Windows 11’s [broad deployment phase](https://www.bleepingcomputer.com/news/microsoft/microsoft-windows-11-now-in-broad-deployment-for-eligible-devices/), so the attackers were well-prepared for this move and waited for the right moment to maximize their operation’s success. RedLine stealer is currently [the most widely deployed](https://www.bleepingcomputer.com/news/security/2easy-now-a-significant-dark-web-marketplace-for-stolen-data/) password, browser cookies, credit card, and cryptocurrency wallet info grabber, so its infections can have dire consequences for the victims._ [According to researchers at HP](https://threatresearch.ext.hp.com/redline-stealer-disguised-as-a-windows-11-upgrade/), who have spotted this campaign, the actors used the seemingly legitimate “[windows-upgraded.com](http://windows-upgraded.com)” domain for the malware distribution part of their campaign. The site appears like a genuine Microsoft site and, if the visitor clicked on the ‘Download Now’ button, they received a 1.5 MB ZIP archive named “Windows11InstallationAssistant.zip,” fetched directly from a Discord CDN… _Although the distribution site is down now, nothing stops the actors from setting up a new domain and restarting their campaign. In fact, this is very likely already happening in the wild._