Think twice before downloading your next Windows 11 app from Google

Searching Google for a Windows utility and clicking the first convincing result has always carried some risk. A newly uncovered network of fake websites has made that familiar habit considerably more dangerous. More than 70 domains were found impersonating popular Windows apps. This includes Microsoft PowerToys, CrystalDiskMark, EasyBCD, Wintoys, Lively Wallpaper, and SignalRGB.

Windows Latest reports that many of the lookalike sites appear above the genuine project pages in Google results, despite having no connection to the developers behind the apps. Some currently redirect their download buttons to legitimate Microsoft Store pages, which may be part of the attack.

The fake sites can earn your trust before turning nasty

The operation came to light after the developer behind Wintoys discovered “wintoys.app”, an unofficial site using an older version of the app’s logo and generic AI-written content. Tracing the domain exposed a collection of 72 similar addresses that had originally been registered through the same company.

Security researchers at Check Point documented a wider ecosystem using a particularly slippery strategy. The impersonation sites can initially link to genuine software, helping them attract visitors and build search rankings. JavaScript can later intercept a click and send selected users through a Traffic Distribution System that changes the destination based on factors such as location, browser, VPN usage, and whether the visitor resembles a security researcher.

Some visitors receive legitimate or unwanted software. Others have been served malware, including RemusStealer, which targets browser data, password managers, cryptocurrency wallets, and authentication tools. Check Point found more than 100 active sites using related routing scripts and over 5,000 VirusTotal submissions connected to the campaign.

Some cloned apps are already serving malware

A fake Lively Wallpaper site distributed a trojanized installer containing a malicious DLL, a persistent remote-access service, and bandwidth-sharing software. The legitimate developer confirmed that the domain had no connection to the project. SignalRGB has also warned about two impersonating domains appearing prominently in search results. Anyone who downloaded an installer from either site has been urged to delete it and perform a full malware scan.

So the best way to avoid it is by sticking to the Microsoft Store or the developer’s verified website or GitHub page. Always check the domain before downloading, confirm that installers carry a valid digital signature, and avoid assuming that Google’s highest result is the official one.