The malicious domains will also try to accept only real PC users. If it detects an internet visit coming from a bot or an automated check from a security researcher, the domains will redirect the traffic to Google.com. “If you pass the checks, the site downloads a file named ms-update32.exe. At 75MB, it feels like a legitimate Windows installer,” Malwarebytes says.

They are getting more sophisticated. So it’s a copy of licences and installer. Naturally, the only legitimate means to have that is windows update from the menù, but if you didn’t know…