A network of 41 websites is actively deceiving users by presenting legitimate download links for popular software and games, only to redirect them to an installer for a program called Download Studio. The sites impersonate a wide range of applications, including VLC Media Player, 7-Zip, Paint.NET, and games like Counter-Strike, Half-Life, Fallout, Roblox, and PUBG.
The deceptive technique exploits a common web safety practice: hovering over a link to inspect its destination. While hovering over a download button on these sites, a browser will display a genuine URL, such as a Steam Store address for a game or VideoLAN's official server for VLC. However, upon clicking, JavaScript on the page intercepts the action, cancels the intended navigation, and instead sends the user through an affiliate redirect to Download Studio.
One example cited is a site offering "GTA 6 PLAY," which provides detailed installation instructions and system requirements for a PC version of Grand Theft Auto VI. This is despite the fact that Rockstar Games has only announced the title for PlayStation 5 and Xbox Series X|S, with no PC release confirmed. Similarly, a fake VLC Media Player page accurately displays the current version number (VLC 3.0.23) and identifies VideoLAN as the developer, further enhancing its credibility before the deceptive redirect occurs.
The delivered software is a Windows installer for Download Studio, approximately 73 MB in size. This installer is digitally signed by Grand Media, TOV, and the signature validates successfully. The installation process registers torrent and magnet associations, and the installer offers an option to make Download Studio the default torrent client. It also enables an automatic updater for the program.
While analysis of the current Download Studio installer did not confirm it as malware, its automatic update mechanism has a history of abuse. In 2020, researchers discovered that Download Studio's automatic updates were used to silently distribute "FakeMBAM," a backdoor disguised as a Malwarebytes installer. This backdoor was observed downloading cryptocurrency miners. At that time, Download Studio's developers acknowledged a security incident involving their continuous-integration server and implemented additional security measures. The company Grand Media, TOV, which signed the current installer, was also associated with the applications involved in the 2020 incident.
The deceptive sites even incorporate advice to check the installer's digital signature, a standard security recommendation. However, because the Download Studio installer is validly signed by Grand Media, TOV, following this advice would still show a valid signature, potentially misleading users into believing they have downloaded their intended software. A valid signature confirms the publisher and integrity of a file but does not guarantee that the software itself is trustworthy or that it is the program the user intended to download.
A more effective check involves examining the file properties after download. By right-clicking the executable, selecting "Properties," and navigating to the "Details" tab, users can see the "File description," "Product name," "Original filename," and copyright information. For the delivered sample, these fields clearly identify "Download Studio," "DS-Setup.exe," and "Grand Media," providing an immediate and obvious mismatch if the user expected to download a different application. The presence of affiliate tracking in the redirect suggests a commercial incentive behind this campaign.
