A hacker is using interest in free antivirus software to spread a nasty malware infection to Windows PCs, according to security researchers. 

The malware is circulating through a fake Bitdefender website at bitdefender-download[.]co, which makes the domain appear legit. But in reality, the site will install three pieces of malware, warns the security provider DomainTools. 

(Credit: PCMag)

The fake site seems to spoof all the elements found on the official site for Bitdefender’s free antivirus program for Windows. However, the download link on the malicious site will deliver a ZIP archive that contains the malicious attack, which includes the so-called “VenomRAT,” a remote access Trojan that can secretly harvest passwords and record keystrokes. 

(Credit: DomainTools)

In addition, the attack will install the StormKitty and SilentTrinity malware programs, which can also steal passwords, including details for cryptocurrency wallets, and maintain long-term access to the PC. “The implications of long-term access may include repeat compromise or selling access,” DomainTools added. 

The security provider suspects the fake Bitdefender site was likely used in phishing attacks since the malicious domain overlapped with internet infrastructure hosting other fake sites impersonating banks and IT services.   

A security researcher on X/Twitter initially spotted the fake Bitdefender last week. In response, the antivirus company said: “This website is not operated by Bitdefender or our partners, and we are working to have it taken offline. We do detect the file that it serves and also block access to the website.”

Although the fake Bitdefender site remains up, Google’s Chrome browser will flag the link to the free software as malicious, preventing users from downloading it. 

Get Our Best Stories!

Stay Safe With the Latest Security News and Updates

Sign up for our SecurityWatch newsletter for our most important privacy and security stories delivered right to your inbox.

By clicking Sign Me Up, you confirm you are 16+ and agree to our Terms of Use and Privacy Policy.

Thanks for signing up!

Your subscription has been confirmed. Keep an eye on your inbox!

About Michael Kan

Senior Reporter

I’ve been working as a journalist for over 15 years—I got my start as a schools and cities reporter in Kansas City and joined PCMag in 2017.

Read Michael’s full bio

Read the latest from Michael Kan