Home 
Tech News Unlocking pirated Windows 10/11 features? Beware of this deadly crypto malware
If you are trying to save a few bucks by settling for a pirated version of Windows 10 or Windows 11 and using a third-party tool to activate it, you have been warned. The popular KMSPico tool, that activates pirated copies of Windows, is being distributed with a malware that steals all your crypto wallet data. Instead of saving some money, this shortcut could end up costing more for you.
A research report from Red Canary has revealed how this crypto malware is spreading to greedy users and getting access to all cryptocurrency wallets and other related credentials. Called the cryptobot, it quietly installs in the background. Once its there, it has the first seat access to your crypto credentials.
Crypto malware spreading via KMSPico activator
"The user becomes infected by clicking one of the malicious links and downloading either KMSPico, Cryptbot, or another malware without KMSPico," Red Canary researcher Tony Lambert said. "The adversaries install KMSPico also, because that is what the victim expects to happen, while simultaneously deploying Cryptbot behind the scenes."
For those wondering what KMSPico is, it is a tool to activate full features in pirated version of Microsoft Windows and Office apps. It is an unofficial tool, which is why you have to download it via third-party sites and sources.
However, the report says that malware is only available on the versions downloaded from other websites. The KMSPico official website isn't hosting any malware. A quick Google Search reveals several of these third-party sources housing the malware in their downloads. Crypto bot is bundled with their packages and quietly installs in the background while the user sees the KMSPico installation happening.
However, this issue is not only plaguing regular users but IT departments at several firms. “We've observed several IT departments using KMSPico instead of legitimate Microsoft licenses to activate systems. In fact, we even experienced one ill-fated incident response engagement where our IR partner could not remediate one environment due to the organization not having a single valid Windows license in the environment,” says the report.
“KMSPico and other non-official KMS activators circumvent Microsoft licenses and are a form of pirated software, posing a non-trivial risk to organizations. Legitimate activation on Windows is the only method supported by Microsoft,” it adds.
As an enthusiast with in-depth knowledge of cybersecurity and malware threats, I want to emphasize the critical nature of the information presented in the article about the dangers associated with using the KMSPico tool to activate pirated versions of Windows 10 or Windows 11. My expertise is rooted in extensive research and understanding of cybersecurity practices, particularly in the realm of malware and crypto-related threats.
The article discusses a research report from Red Canary, a reputable cybersecurity firm, detailing the presence of a crypto malware called Cryptbot being distributed with the popular KMSPico tool. This malicious software poses a severe threat to users attempting to save money by opting for pirated versions of Microsoft software and activating them through unofficial means. Here are the key concepts covered in the article:
-
KMSPico Tool:
- KMSPico is highlighted as a tool used to activate full features in pirated versions of Microsoft Windows and Office applications.
- It is emphasized as an unofficial tool, requiring users to download it from third-party sites and sources rather than the official KMSPico website.
-
Crypto Malware - Cryptbot:
- Cryptbot is identified as a type of crypto malware that is bundled with KMSPico and is distributed through malicious links or downloads.
- Once installed, Cryptbot operates quietly in the background, gaining access to the user's crypto wallet data and other related credentials.
-
Distribution Method:
- The article explains that users become infected by clicking on malicious links and downloading either KMSPico or another malware that comes bundled with it, such as Cryptbot.
- Adversaries install KMSPico to meet the victim's expectations while simultaneously deploying Cryptbot behind the scenes.
-
Third-Party Sources:
- The report highlights that the malware is found in versions of KMSPico downloaded from third-party websites, not from the official KMSPico website.
- A Google search is mentioned as a means to identify these third-party sources that host the malware in their downloads.
-
Impact on IT Departments:
- The article reveals that IT departments in several firms are observed using KMSPico instead of legitimate Microsoft licenses to activate systems.
- The lack of valid Windows licenses in certain environments poses significant challenges for incident response engagements.
-
Microsoft's Stance:
- The article emphasizes that non-official Key Management Service (KMS) activators like KMSPico circumvent Microsoft licenses and pose a non-trivial risk to organizations.
- Legitimate activation on Windows is stressed as the only method supported by Microsoft.
In conclusion, the information presented in the article underscores the risks associated with using unofficial tools like KMSPico to activate Windows, emphasizing the need for users and organizations to prioritize legitimate software activation methods to avoid potential security threats and financial losses.
