Bleeping Computer

Fake MAS Windows activation domain used to spread PowerShell malware

A typosquatted domain impersonating the Microsoft Activation Scripts (MAS) tool was used to distribute malicious PowerShell scripts that infect Windows systems with the 'Cosmali Loader'.
TechSpot

Your pirated copy of Windows might have just stopped working

Black flag down: Microsoft has closed an activation loophole that was widely used by software pirates to run Windows and Office without a legitimate license. The group behind the activation tool has ...
GIGAZINE

Fake Windows activation domains used to spread PowerShell malware

typosquatting using names that are very similar to the domains used for activation in Microsoft Activation Scripts (MAS), an open-source tool that can activate licenses for Windows and Microsoft ...