Listen to the episode
TLDR
Attackers are cloning the homepages of trusted brands like CNN, Avast, and Stremio to push a "free app" that is actually O&O Syspectr, a legitimate remote administration tool already linked to the attacker's account. Once installed, the...
How it works
Attackers are cloning the homepages of trusted brands like CNN, Avast, and Stremio to push a "free app" that is actually O&O Syspectr, a legitimate remote administration tool already linked to the attacker's account. Once installed, the...
Red flags
- : The URL is a lookalike domain (e.g., avast premium[.]shop , stremiotv[.]online ) instead of the brand's official site. A pop up aggressively offers a "new app" or "free download" right after landing on the page, before you asked for it. The installer filename contains a long random hex string (e.g., CNN App.setup4693fd... ) — a hallmark of pre configured remote access payloads
What to do
- 1: Always download software only from the vendor's official domain
- 2type the address yourself or use a bookmark. Right click any installer, open Properties → Details , and verify that File description and Product name match the brand you
Source
malwarebytes
Source reviewed by Mythos Forensic Team
https://www.malwarebytes.com/blog/threat-intel/2026/08/fake-popular-sites-offer-a-free-app-instead-take-over-pcsFAQ
Is Fake CNN, Avast and Stremio download sites install a remote access tool on your PC a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
: The URL is a lookalike domain (e.g., avast premium[.]shop , stremiotv[.]online ) instead of the brand's official site. A pop up aggressively offers a "new app" or "free download" right after landing on the page, before you asked for it. The installer filename contains a long random hex string (e.g., CNN App.setup4693fd... ) — a hallmark of pre configured remote access payloads
What should I do first?
: Always download software only from the vendor's official domain; type the address yourself or use a bookmark. Right click any installer, open Properties → Details , and verify that File description and Product name match the brand you
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.