Over 70 fake software sites use AI to spread malware

A new report warns users to be careful when downloading apps from third-party websites. Researchers found over 70 sites using AI-generated content to rank high in Google search, sometimes even above official pages, to spread malware.

These sites are built with WordPress, use fake AI content, and show old Microsoft logos. The download buttons first point to the real Microsoft Store to gain trust, then switch to malicious files. Affected apps include PowerToys and CrystalDiskMark.

Check Point Research says these sites are owned by the same person, registered through Epik Inc. and later moved to Dynadot LLC. Some sites use Amazon CloudFront scripts to track users and decide who gets malware. The campaign started building search rankings in September 2025 and began distributing malware in January 2026.