--- title: Attackers use fake Windows 11 Upgrade to Spread Malware description: Fake Windows 11 download links are being used to spread malware once again, this time to coincide with the final phase of its rollout. image: https://blog.teamascend.com/hubfs/Attackers%20use%20fake%20Windows%2011%20Upgrade%20to%20Spread%20Malware.png --- [Skip to main content](https://blog.teamascend.com/blog/attackers-use-fake-windows-11-upgrade-to-spread-malware#main) [![cropped-Ascend-Technologies\_Vertical\_FullColor\_White](https://blog.teamascend.com/hs-fs/hubfs/Logos/cropped-Ascend-Technologies_Vertical_FullColor_White.png?width=150&height=118&name=cropped-Ascend-Technologies_Vertical_FullColor_White.png) ![cropped-Ascend-Technologies\_Vertical\_FullColor\_White](https://blog.teamascend.com/hs-fs/hubfs/Logos/cropped-Ascend-Technologies_Vertical_FullColor_White.png?width=150&height=118&name=cropped-Ascend-Technologies_Vertical_FullColor_White.png)](https://teamascend.com/) - [Show submenu for Services Services](http://teamascend.com/services/) - [Show submenu for IT Consulting IT Consulting](https://teamascend.com/services/strategic-consulting/) - [Healthcare Consulting](https://teamascend.com/services/healthcare/) - [Show submenu for Cybersecurity Cybersecurity](https://teamascend.com/services/cybersecurity/) - [Ascend Defend | Microsoft Security](https://teamascend.com/services/microsoft-365/microsoft-security-ascend-defend/) - [Managed Detection & Response](https://teamascend.com/services/cybersecurity/managed-detection-response/) - [Identity Protection & MFA](https://teamascend.com/services/cybersecurity/identity-protection-mfa/) - [Email Security](https://teamascend.com/services/cybersecurity/email-security/) - [Perimeter Security](https://teamascend.com/services/cybersecurity/perimeter-security-ngfw/) - [vCISO](https://teamascend.com/services/cybersecurity/vciso/) - [Security Risk Assessment](https://teamascend.com/services/it-assessments/security-risk-assessment/) - [Penetration Testing](https://teamascend.com/services/infrastructure/penetration-testing/) - [Vulnerability Management](https://teamascend.com/services/cybersecurity/vulnerability-management-program/) - [Security Awareness Training](https://teamascend.com/services/cybersecurity/security-awareness-program/) - [Show submenu for IT Infrastructure IT Infrastructure](https://teamascend.com/services/infrastructure/) - [24/7 Support Desk](https://teamascend.com/services/infrastructure/support-desk/) - [VCIO](https://teamascend.com/services/infrastructure/vcio/) - [Managed Infrastructure](https://teamascend.com/services/infrastructure/managed-infrastructure-services/) - [Data Protection (BaaS)](https://teamascend.com/services/infrastructure/data-protection/) - [Onsite Rounding](https://teamascend.com/services/infrastructure/onsite-rounding/) - [Application Administration Services](https://teamascend.com/services/infrastructure/application-administration/) - [IT Infrastructure Assessment](https://teamascend.com/services/it-assessments/infrastructure-assessment/) - [Product](https://teamascend.com/services/infrastructure/product/) - [Show submenu for Cloud Cloud](https://teamascend.com/services/cloud-computing/) - [Ascend Cloud | Managed Private Data Center](https://teamascend.com/services/cloud-computing/edafio-cloud/) - [Hybrid Cloud](https://teamascend.com/services/cloud-computing/hybrid-cloud-solutions/) - [Cloud Security (CSPM)](https://teamascend.com/services/cloud-computing/cloud-security-posture-management/) - [Cloud Assessment](https://teamascend.com/services/cloud-computing/cloud-assessment/) - [Digitial Workspace Deployment](https://teamascend.com/services/cloud-computing/digital-workspace-deployment/) - [Cloud Migration](https://teamascend.com/services/cloud-computing/cloud-migration/) - [Show submenu for Microsoft Services Microsoft Services](https://teamascend.com/services/microsoft-365/) - [Ascend Defend | Microsoft Security](https://teamascend.com/services/microsoft-365/microsoft-security-ascend-defend/) - [Microsoft 365 Copilot](https://teamascend.com/services/microsoft-365/microsoft-365-copilot/) - [Microsoft Licensing](https://teamascend.com/services/microsoft-365/microsoft-licensing/) - [Microsoft 365 Management](https://teamascend.com/services/microsoft-365/microsoft-365-management/) - [Microsoft 365 Migration](https://teamascend.com/services/microsoft-365/) - [Show submenu for Salesforce Salesforce](https://teamascend.com/salesforce-services/) - [Consulting Services](https://teamascend.com/salesforce-services/salesforce-consulting-services/) - [Implementation Services](https://teamascend.com/salesforce-services/salesforce-implementation-services/) - [Managed Services](https://teamascend.com/salesforce-services/salesforce-managed-services/) - [Embedded Experts](https://teamascend.com/salesforce-services/salesforce-embedded-experts/) - [Optimization Assessment](https://teamascend.com/salesforce-services/salesforce-optimization-assessment/) - [Salesforce AppExchange](https://teamascend.com/salesforce-services/salesforce-appexchange/) - [HubSpot Services](https://teamascend.com/services/hubspot-services/) - [App Development](https://teamascend.com/services/application-development/) - [Show submenu for Industries Industries](https://teamascend.com/industries/) - [Financial Services](https://teamascend.com/industries/financial-services/) - [Private Equity](https://teamascend.com/industries/private-equity/) - [Insurance](https://teamascend.com/industries/insurance/) - [Manufacturing](https://teamascend.com/industries/manufacturing/) - [Healthcare](https://teamascend.com/industries/healthcare/) - [Legal](https://teamascend.com/industries/legal/) - [Accounting](https://teamascend.com/industries/accounting/) - [Show submenu for Resources Resources](https://teamascend.com/resources/) - [Client Success Stories](https://teamascend.com/client-success-stories/) - [Events](https://teamascend.com/events/) - [Solutions-Focused PDFs](https://teamascend.com/resources/#solutions) - [Blog](https://blog.teamascend.com/) - [Webinars](https://teamascend.com/resources/?_resource_type=webinar) - [All Resources](https://teamascend.com/resources/) - Show submenu for Company Company - [About Ascend Technologies](https://teamascend.com/about/) - [Leadership Team](https://teamascend.com/about/team/) - [Partners With Us](https://teamascend.com/about/partner-with-us/) - [Awards & Recognitions](https://teamascend.com/about/awards/) - [Certifications](https://teamascend.com/about/certifications/) - [Careers](https://teamascend.com/careers/) - [Internships](https://teamascend.com/careers/internships/) - [Connect](https://teamascend.com/contact/) Open main navigation Close main navigation - Show submenu for Services Services - Services - [Services](http://teamascend.com/services/) - Show submenu for IT Consulting IT Consulting - IT Consulting - [IT Consulting](https://teamascend.com/services/strategic-consulting/) - [Healthcare Consulting](https://teamascend.com/services/healthcare/) - Show submenu for Cybersecurity Cybersecurity - Cybersecurity - [Cybersecurity](https://teamascend.com/services/cybersecurity/) - [Ascend Defend | Microsoft Security](https://teamascend.com/services/microsoft-365/microsoft-security-ascend-defend/) - [Managed Detection & Response](https://teamascend.com/services/cybersecurity/managed-detection-response/) - [Identity Protection & MFA](https://teamascend.com/services/cybersecurity/identity-protection-mfa/) - [Email Security](https://teamascend.com/services/cybersecurity/email-security/) - [Perimeter Security](https://teamascend.com/services/cybersecurity/perimeter-security-ngfw/) - [vCISO](https://teamascend.com/services/cybersecurity/vciso/) - [Security Risk Assessment](https://teamascend.com/services/it-assessments/security-risk-assessment/) - [Penetration Testing](https://teamascend.com/services/infrastructure/penetration-testing/) - [Vulnerability Management](https://teamascend.com/services/cybersecurity/vulnerability-management-program/) - [Security Awareness Training](https://teamascend.com/services/cybersecurity/security-awareness-program/) - Show submenu for IT Infrastructure IT Infrastructure - IT Infrastructure - [IT Infrastructure](https://teamascend.com/services/infrastructure/) - [24/7 Support Desk](https://teamascend.com/services/infrastructure/support-desk/) - [VCIO](https://teamascend.com/services/infrastructure/vcio/) - [Managed Infrastructure](https://teamascend.com/services/infrastructure/managed-infrastructure-services/) - [Data Protection (BaaS)](https://teamascend.com/services/infrastructure/data-protection/) - [Onsite Rounding](https://teamascend.com/services/infrastructure/onsite-rounding/) - [Application Administration Services](https://teamascend.com/services/infrastructure/application-administration/) - [IT Infrastructure Assessment](https://teamascend.com/services/it-assessments/infrastructure-assessment/) - [Product](https://teamascend.com/services/infrastructure/product/) - Show submenu for Cloud Cloud - Cloud - [Cloud](https://teamascend.com/services/cloud-computing/) - [Ascend Cloud | Managed Private Data Center](https://teamascend.com/services/cloud-computing/edafio-cloud/) - [Hybrid Cloud](https://teamascend.com/services/cloud-computing/hybrid-cloud-solutions/) - [Cloud Security (CSPM)](https://teamascend.com/services/cloud-computing/cloud-security-posture-management/) - [Cloud Assessment](https://teamascend.com/services/cloud-computing/cloud-assessment/) - [Digitial Workspace Deployment](https://teamascend.com/services/cloud-computing/digital-workspace-deployment/) - [Cloud Migration](https://teamascend.com/services/cloud-computing/cloud-migration/) - Show submenu for Microsoft Services Microsoft Services - Microsoft Services - [Microsoft Services](https://teamascend.com/services/microsoft-365/) - [Ascend Defend | Microsoft Security](https://teamascend.com/services/microsoft-365/microsoft-security-ascend-defend/) - [Microsoft 365 Copilot](https://teamascend.com/services/microsoft-365/microsoft-365-copilot/) - [Microsoft Licensing](https://teamascend.com/services/microsoft-365/microsoft-licensing/) - [Microsoft 365 Management](https://teamascend.com/services/microsoft-365/microsoft-365-management/) - [Microsoft 365 Migration](https://teamascend.com/services/microsoft-365/) - Show submenu for Salesforce Salesforce - Salesforce - [Salesforce](https://teamascend.com/salesforce-services/) - [Consulting Services](https://teamascend.com/salesforce-services/salesforce-consulting-services/) - [Implementation Services](https://teamascend.com/salesforce-services/salesforce-implementation-services/) - [Managed Services](https://teamascend.com/salesforce-services/salesforce-managed-services/) - [Embedded Experts](https://teamascend.com/salesforce-services/salesforce-embedded-experts/) - [Optimization Assessment](https://teamascend.com/salesforce-services/salesforce-optimization-assessment/) - [Salesforce AppExchange](https://teamascend.com/salesforce-services/salesforce-appexchange/) - [HubSpot Services](https://teamascend.com/services/hubspot-services/) - [App Development](https://teamascend.com/services/application-development/) - Show submenu for Industries Industries - Industries - [Industries](https://teamascend.com/industries/) - [Financial Services](https://teamascend.com/industries/financial-services/) - [Private Equity](https://teamascend.com/industries/private-equity/) - [Insurance](https://teamascend.com/industries/insurance/) - [Manufacturing](https://teamascend.com/industries/manufacturing/) - [Healthcare](https://teamascend.com/industries/healthcare/) - [Legal](https://teamascend.com/industries/legal/) - [Accounting](https://teamascend.com/industries/accounting/) - Show submenu for Resources Resources - Resources - [Resources](https://teamascend.com/resources/) - [Client Success Stories](https://teamascend.com/client-success-stories/) - [Events](https://teamascend.com/events/) - [Solutions-Focused PDFs](https://teamascend.com/resources/#solutions) - [Blog](https://blog.teamascend.com/) - [Webinars](https://teamascend.com/resources/?_resource_type=webinar) - [All Resources](https://teamascend.com/resources/) - Show submenu for Company Company - Company - [About Ascend Technologies](https://teamascend.com/about/) - [Leadership Team](https://teamascend.com/about/team/) - [Partners With Us](https://teamascend.com/about/partner-with-us/) - [Awards & Recognitions](https://teamascend.com/about/awards/) - [Certifications](https://teamascend.com/about/certifications/) - [Careers](https://teamascend.com/careers/) - [Internships](https://teamascend.com/careers/internships/) - [Connect](https://teamascend.com/contact/) - [24/7 Client Services](https://portal-ascend.okta.com/) [24/7 Client Services](https://portal-ascend.okta.com/) Alerts, Cybersecurity # Attackers use fake Windows 11 Upgrade to Spread Malware ![Default Author](https://blog.teamascend.com/hubfs/Logos/Ascend/Ascend%20Technologies_Vertical_Blue.png) TEAM ASCEND February 15, 2022 - [![LinkedIn](https://blog.teamascend.com/hubfs/LinkedIn-color%20(1).svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fblog.teamascend.com%2Fblog%2Fattackers-use-fake-windows-11-upgrade-to-spread-malware) - [![Facebook](https://blog.teamascend.com/hubfs/Group%203%20(1).svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fblog.teamascend.com%2Fblog%2Fattackers-use-fake-windows-11-upgrade-to-spread-malware) - [![Email](https://blog.teamascend.com/hubfs/Group%20427320686.svg)](mailto:?subject=%3Cspan+id%3D%22hs_cos_wrapper_name%22+class%3D%22hs_cos_wrapper+hs_cos_wrapper_meta_field+hs_cos_wrapper_type_text%22+style%3D%22%22+data-hs-cos-general-type%3D%22meta_field%22+data-hs-cos-type%3D%22text%22+%3EAttackers+use+fake+Windows+11+Upgrade+to+Spread+Malware%3C%2Fspan%3E&body=https%3A%2F%2Fblog.teamascend.com%2Fblog%2Fattackers-use-fake-windows-11-upgrade-to-spread-malware) ![](https://blog.teamascend.com/hubfs/Attackers%20use%20fake%20Windows%2011%20Upgrade%20to%20Spread%20Malware.png) [Researchers at HP released a new article today warning of a new scam that attackers](https://threatresearch.ext.hp.com/redline-stealer-disguised-as-a-windows-11-upgrade/)use to spread the RedLine family of malware. This scam tricks users into downloading a fake Windows 11 upgrade package that secretly installs the malware onto the user’s computer. This is similar to a previous campaign that impersonated a Discord download page to spread the same RedLine malware in December 2021. Last week, Microsoft announced they were entering their final phase of free upgrades to Windows 11 from Windows 10 devices. This created a perfect opportunity for attackers to launch a new campaign to spread malware disguised as a Windows 11 upgrade module. People would be eager to get the update before the free offer expires. The attackers created a fake Windows 11 upgrade page that looks similar to what Microsoft would legitimately produce. Using the domain *windows-upgraded\[.\]com*, the site includes a link to download a ‘Windows 11 upgrade assistant.’ The file downloaded is called Windows11InstallationAssistant.zip. Once extracted and executed, it installs RedLine Stealer malware using DLL files and various other means. The RedLine Stealer then gathers information from your computer, including stored passwords in web browsers, cryptocurrency wallet information, installed software, and more. It sends this information through a connection to the IP address 45\[.\]146\[.\]166\[.\]38 on port 2715. This sophisticated attack is perfectly timed with the Microsoft announcement to ensure it is even more effective at spreading the malware. While it can be challenging to recognize fake pages like the one shown above, here are a few tips to keep you safe from spoofing attacks like this.   ## Tip #1: Always go Directly to the Source When downloading software or upgrading a device, always go directly to the company rather than a third-party site to ensure that you get a legitimate version of the software rather than one that may have malware installed. While many reputable third-party sites exist, getting the software directly from the source should be your first choice. This also means using update features in applications rather than manually downloading updates.   ## Tip #2: Verify Your Google Search If you Google or Bing a piece of software or upgrade, verify what link you click before downloading anything from the website. Search engines like Google often put advertising as the first few results on a search. This can be manipulated to allow an attacker to have their lousy website show up as the top result. For example, when Googling ‘Windows 11 Upgrade’, an attacker could get their website as the first ad result with the tagline ‘Windows 11 Upgrade Here!’ Before you click a link in Google or download anything from a website, verify it is legitimate. Look at the domain and determine if that is normal for the company. For example, windows-upgraded\[.\]com is not a typical Microsoft URL that usually contains Microsoft\[.\]com. This also ties back into Tip 1, going directly to the source.   ## Tip #3: Verify the Files You Download Via Hashing Many companies provide a hash for their files to verify that they have not been modified. A hash is a calculated value always the same if the file does not change. For example, if I have a file title sparkle-kittens.jpg, the hash might come out as 123abc. If that file is modified in any way, the hash changes. This allows the user to know whether the file is legitimate or not. If a company says their file should be 123abc, and you create a hash for it, that is 456def. You know that your file is not a legitimate file submitted by the company. You can calculate file hashes using built-in tools on Windows or Apple devices.   ## Tip #4: Reach Out to the Experts for Help You don’t have to go it alone. When all else fails, you can contact an IT expert to help you find the right software to download. Verifying software or download sites is simple and quick with the right expertise. Your IT provider should help answer any questions about getting the software to ensure it is legitimate. These tips should help you get the right software without downloading malware. With the right tools and guidance in IT, you’ll be confident in your security. I'm not sure if your security is where it needs to be or if you have more questions on how you and your company can stay safe. [Reach out to the security experts](https://teamascend.com/contact/) at Ascend for a quick consultation on how we can keep your organization from these types of attacks and more.   [![New call-to-action](https://no-cache.hubspot.com/cta/default/2733374/d642d48f-f65a-4c45-aa94-29ec149674d1.png)](https://cta-redirect.hubspot.com/cta/redirect/2733374/d642d48f-f65a-4c45-aa94-29ec149674d1)   ### Table of Contents #### Get Insights Sent to Your Inbox ## Related Articles ![How to Build an AI Governance Framework a Lean IT Team Can Run](https://blog.teamascend.com/hubfs/software-engineers-collaborating-on-code-in-office-2026-09-21-23-15-07-utc.jpg) Alerts, Cybersecurity ### [How to Build an AI Governance Framework a Lean IT Team Can Run](https://blog.teamascend.com/blog/ai-governance-framework-for-lean-it-teams-ascend) September 24, 2026 [Read Now ![arrow](https://blog.teamascend.com/hubfs/SVG%20(2).svg)](https://blog.teamascend.com/blog/ai-governance-framework-for-lean-it-teams-ascend) ![How to Choose the Right Salesforce Products for Your Business](https://blog.teamascend.com/hubfs/AdobeStock_1458786464.jpeg) Alerts, Cybersecurity ### [How to Choose the Right Salesforce Products for Your Business](https://blog.teamascend.com/blog/how-to-choose-the-right-salesforce-products-for-your-business) September 22, 2026 [Read Now ![arrow](https://blog.teamascend.com/hubfs/SVG%20(2).svg)](https://blog.teamascend.com/blog/how-to-choose-the-right-salesforce-products-for-your-business) ![What Is Shadow AI, and Why Is It a Compliance Risk Right Now?](https://blog.teamascend.com/hubfs/woman-working-from-home-at-desk-with-laptop-2026-03-13-01-57-07-utc.jpg) Alerts, Cybersecurity ### [What Is Shadow AI, and Why Is It a Compliance Risk Right Now?](https://blog.teamascend.com/blog/shadow-ai-compliance-risk-regulated-industries) September 17, 2026 [Read Now ![arrow](https://blog.teamascend.com/hubfs/SVG%20(2).svg)](https://blog.teamascend.com/blog/shadow-ai-compliance-risk-regulated-industries) [![Ascend Technologies](https://blog.teamascend.com/hs-fs/hubfs/Logos/Ascend/Ascend%20Technologies_Horizontal_FullColor_White.png?width=200&height=107&name=Ascend%20Technologies_Horizontal_FullColor_White.png)](https://teamascend.com/) Contact 833-639-2285 - - - - - - Company - [About](https://teamascend.com/about/) - [Services](https://teamascend.com/services/) - [Testimonials](https://teamascend.com/client-success-stories/) - [Partner With Us](https://teamascend.com/about/partner-with-us/) - [Resources](https://teamascend.com/resources/) - [Contact](https://teamascend.com/contact/) - [Careers](https://teamascend.com/careers/) - Services - [IT Consulting](https://teamascend.com/services/strategic-consulting/) - [Cybersecurity](https://teamascend.com/services/cybersecurity/) - [IT Infrastructure](https://teamascend.com/services/infrastructure/) - [Cloud](https://teamascend.com/services/cloud-computing/) - [24/7 Support Desk](https://teamascend.com/services/infrastructure/support-desk/) - [Microsoft Services](https://teamascend.com/services/microsoft-365/) - [Salesforce Services](https://teamascend.com/salesforce-services/) - [HubSpot Services](https://teamascend.com/services/hubspot-services/) - [App Development](https://teamascend.com/services/application-development/) ### Empowering Technology. Powered by People. Technology is critical to businesses across all industries. Today's technology must be smart, reliable, adaptable, and secure. At Ascend Technologies, we deliver solutions at the highest level, from cloud computing to proactive cybersecurity strategies to Salesforce excellence. And the team? As impressive as the tech. Our practical support is focused on one thing: your success. Let's see what we can do together. [Contact Us](https://teamascend.com/contact/) ©2026 Ascend Technologies, LLC, All Rights Reserved | [Privacy Policy](https://teamascend.com/privacy-policy/) ```json { "@context" : "https://schema.org", "@type" : "WebPage", "breadcrumb" : { "@type" : "BreadcrumbList", "itemListElement" : [ { "@type" : "ListItem", "item" : "https://blog.teamascend.com", "name" : "Home", "position" : 1 } ] }, "dateModified" : "2024-07-19T21🇲🇲42", "description" : "Fake Windows 11 download links are being used to spread malware once again, this time to coincide with the final phase of its rollout.", "name" : "Attackers use fake Windows 11 Upgrade to Spread Malware", "primaryImageOfPage" : { "@type" : "ImageObject", "url" : "https://content.teamascend.com/hubfs/Attackers%20use%20fake%20Windows%2011%20Upgrade%20to%20Spread%20Malware.png" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://content.teamascend.com/hubfs/Ascend-Technologies-HubSpot-Logo.png" }, "name" : "Ascend Technologies", "url" : "https://blog.teamascend.com" }, "url" : "https://blog.teamascend.com/blog/attackers-use-fake-windows-11-upgrade-to-spread-malware" } ```