This fake Windows 11 download page can steal your data | 91mobiles.com

Kean-eyed viewers at HP quickly discovered the malicious activity and reported the complete analysis in a research report. The report breaks down the entire campaign that goes by – windowsupgraded[.]com in extreme detail. The Windows 11 clone page redirects users to a RedLine Stealer installer that steals valuable information such as credit card details, saved credentials, autocomplete data, and cryptocurrencies. We’ll get back to the RedLine Stealer part later.

The HP report also mentions a similar activity that took place in December 2021, where a campaign initiated a malware campaign to download a popular messaging service – Discord. Furthermore, the report also mentions that the same RedLine Stealer was used to steal data under the domain – discrodappp[.]com. Both domains windowsupgraded[.]com and discrodappp[.]com used the same domain registrar, DNS servers, and opted for the RedLine Stealer tool.

In case you want to download Windows 11, head over to here. Don’t worry, it’s our blog post and not a malware tool that steals your valuable data.

And if you want to check if your system matches the requirement, check this Windows 11 system requirements article.

What is RedLine Stealer?

RedLine Stealer is a malware that can be purchased at $100/$150 (around Rs 8,000/11,000) depending on the version or on a subscription basis of $100 per month(around Rs 8,000) on the dark web. This malware collects data from browsers such as stored passwords, autocomplete data, credit card information, and even cryptocurrencies. When executing on a target machine, system data is collected, including information such as the login, location data, hardware configuration, and information about installed security software.