Attackers are leveraging highly convincing fake websites to distribute a legitimate remote administration tool, O&O Syspectr, to gain unauthorized access to Windows computers. The campaign employs lookalike sites impersonating popular brands such as CNN, Avast, and Stremio, as well as custom lures like a fake cryptocurrency mining game.
The fraudulent websites are meticulously designed to mimic the appearance and layout of their legitimate counterparts. For instance, the fake CNN site, app.cnn-news[.]net, closely replicates CNN's homepage, displaying current headlines and a "Live Updates" tag. A pop-up quickly prompts visitors to download a "new CNN app," which is actually the O&O Syspectr installer. Similarly, avast-premium[.]shop mimics Avast's download page, offering "Avast One," and stremiotv[.]online imitates the media-center app Stremio.
Instead of delivering the expected software, these sites provide a digitally signed installer for O&O Syspectr, a genuine remote administration tool developed by O&O Software GmbH, a German company. This tool is typically used by IT departments for legitimate system management. The installers are pre-configured to link to an attacker-controlled Syspectr account, granting the attacker remote access to the victim's PC. This access can include the ability to run commands, install additional software, browse files, and make system changes.
The installers for the fake CNN, Avast, and Stremio apps all share the same embedded Syspectr account ID: 4693fd-d903-4791-8f58-975261c93ca2. This indicates that these lures are part of a single, coordinated campaign, simply reskinned for different brands. A separate set of lures, found on syncminer[.]xyz and idleminer[.]pro, uses a fake browser-based cryptocurrency mining game to entice downloads. These sites distribute an installer with a different Syspectr account ID: 9158bf2a-ff25-4290-b96c-2dc5eb310391. This suggests either a second operator using the same tactic or the same group operating under a different account.
Because O&O Syspectr is legitimate, digitally signed software, standard antivirus solutions may not flag it as malicious, as they are designed to detect harmful software, not legitimate tools being misused. The attackers exploit this by convincing users to install the tool themselves.
O&O Software GmbH has responded to the abuse by disabling Remote Desktop and Remote Console access for free Syspectr accounts, restricting these features to paid plans only. The company has also identified and suspended the abusive accounts, preventing them from adding new devices. O&O's analysis confirmed that the attackers primarily utilized the Remote Console feature. The company stated it would continue monitoring for similar patterns and implement further restrictions if necessary.
Users can identify these deceptive installers by checking the file properties on Windows. Right-clicking the installer, selecting "Properties," and navigating to the "Details" tab will reveal the "File description" and "Product name" fields, which will identify the software as "O&O Syspectr" and display the copyright for "O&O Software GmbH." While attackers can change the filename, these embedded details are part of the digitally signed software and cannot be altered without invalidating the signature.
To protect against such attacks, users are advised to download software exclusively from official vendor websites. If O&O Syspectr is found installed without explicit user consent, it should be uninstalled via Windows Settings and a full antivirus scan should be performed. Additionally, if an installer of this type was recently run, users should change passwords for any accounts accessed on the affected machine from a clean device.
