“Zero detections across 69 engines”: A fake Windows 11 24H2 update is slipping past antivirus to try and steal your passwords
Security researchers have discovered a sophisticated malware campaign distributing a fake Windows 11 24H2 update through fraudulent Windows 11 support pages. The malware is remarkably effective at evading detection, registering zero detections across 69 different antivirus engines when first analyzed—a significant concern for cybersecurity.
The malicious update is specifically designed to steal passwords from infected systems. Attackers have used a convincing fake support page to distribute the malware, taking advantage of users who believe they are performing legitimate system updates. This technique exploits user trust in official Windows update processes, making it particularly dangerous to unsuspecting users.
The report highlights how cybercriminals are increasingly employing sophisticated attack methods to compromise systems. The emergence of generative AI tools has contributed to the advancement of these techniques, enabling bad actors to create more convincing phishing pages and social engineering campaigns.
The near-zero detection rate across major antivirus engines suggests the malware may use advanced obfuscation or evasion techniques. This poses a significant threat to Windows 11 users who may not have updated security solutions or who fall victim to the convincing fake update page.
This incident underscores the importance of user vigilance when downloading updates, verifying URLs before entering sensitive information, and ensuring antivirus software remains current. Users are advised to only download Windows updates through official Windows Update channels or the legitimate Microsoft website, not through third-party support pages.