72 Malicious Windows Software Sites Discovered Using AI and SEO Poisoning

Security researchers have identified 72 malicious Windows software download sites that leverage AI-generated content and SEO poisoning to mimic legitimate sources. These sites impersonate popular tools like PowerToys and EasyBCD to distribute malware after building user trust. This campaign highlights how threat actors are using generative AI to rapidly scale convincing fake websites, lowering the barrier to entry for distributing malware. By initially offering legitimate downloads, attackers successfully bypass early detection and manipulate search engine rankings to outrank official sites. The malicious sites use Amazon CloudFront scripts to intercept download clicks and employ a traffic distribution system to redirect users based on their location, browser, and whether they are security researchers. The domains were registered under a single owner and have been active in building search rankings since late 2025.