Fake MAS Windows activation domain used to spread PowerShell malware Post author:Brian Post published: December 24, 2025 Post category:Uncategorized Post comments:0 Comments A typosquatted domain impersonating the Microsoft Activation Scripts (MAS) tool was used to distribute malicious PowerShell scripts that infect Windows systems with the ‘Cosmali Loader’. […] You Might Also Like Azure domains and Google abused to spread disinformation and malware August 17, 2024 SEXi ransomware rebrands to APT INC, continues VMware ESXi attacks July 16, 2024 Microsoft fixes Windows bug breaking localhost HTTP connections October 17, 2025 Leave a Reply Cancel replyCommentEnter your name or username to comment Enter your email address to comment Enter your website URL (optional) Save my name, email, and website in this browser for the next time I comment.