{
  "family": "fakeoff",
  "sample_count": 4,
  "category": "advanced_threat",
  "description": "Rogue:Win32/Fakeoff is a deceptive class of malware known as Rogue Security Software, or 'Fake AV'. It is explicitly designed to scam victims out of money by aggressively displaying highly realistic, but entirely fabricated, security alerts and system scans. Fakeoff claims the user's computer is heavily infected with severe viruses and demands immediate payment (often via credit card) for a 'premium license' to remove the non-existent threats.<br><br><b>Understanding Fakeoff (Rogue AV)</b><br>To an end-user, a Fakeoff infection is terrifying and highly disruptive. The malware often takes over the entire screen, blocks access to the Task Manager, and constantly bombards the user with fake infection warnings. For a SOC analyst, Fakeoff is a social engineering attack that preys on fear. While the primary goal is financial fraud via the fake license purchase, the malware also lowers system defenses, making the machine vulnerable to actual secondary infections.<br><br><b>Execution and Extortion Mechanics</b><br>Fakeoff is typically distributed via drive-by downloads on compromised websites or through malicious advertisements (malvertising) (`T1189`). When executed, it installs itself deeply into the system, often modifying the Registry Run keys to ensure it starts before the Windows shell (`T1547.001`). It employs aggressive defense evasion by actively searching for and forcefully terminating the processes of legitimate antivirus software and essential system utilities like `taskmgr.exe` and `regedit.exe` (`T1562.001`). The malware then displays a fake, highly polished graphical interface mimicking a legitimate security center (`T1036`), running a fake 'scan' that guarantees finding dozens of critical threats.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is financial loss (if the user pays) and a completely unusable system. Host-based IoCs include the inability to launch Task Manager or legitimate AV programs, EDR alerts for process termination targeting security tools, and the presence of suspicious, highly visible executable files in `%AppData%` or `%ProgramFiles%`. Network IoCs include outbound HTTP/HTTPS traffic to payment processing domains associated with the rogue software.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Fakeoff and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Fakeoff is classified as a Advanced Threat. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Fakeoff establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Fakeoff typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Fakeoff compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Fakeoff should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What lateral movement and credential access tactics does Fakeoff leverage in enterprise intrusions?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Fakeoff frequently utilizes privileged account harvesting techniques such as LSASS memory dumping, Kerberoasting, and token impersonation to escalate privileges. Once administrative credentials are acquired, it pivots across the victim network utilizing living-off-the-land binaries (LOLBins) such as WMI, PowerShell remoting, and PsExec, or abuses remote desktop protocols (RDP) to reach critical internal repositories and domain controllers."
      }
    },
    {
      "@type": "Question",
      "name": "How does Fakeoff maintain covert communications and evade perimeter network monitoring?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Fakeoff often relies on multi-stage command and control (C2) architectures utilizing encrypted protocols over standard web ports (HTTPS/443 or DNS tunneling) to blend in with legitimate enterprise network traffic. Many variants incorporate proxy networks, domain fronting, or cloud services (such as Microsoft Graph API, Google Drive, or Telegram) to masquerade C2 channels, bypassing traditional signature-based egress filtering."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1547.001",
    "T1562.001",
    "T1036",
    "T1189"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1036",
      "name": "Masquerading (Spoofing legitimate security software GUIs)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Terminating real AV)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys",
      "tactic": "Persistence"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Boot the infected machine into Windows Safe Mode with Networking; Fake AV programs often fail to load their persistence mechanisms in Safe Mode, allowing for manual removal.",
    "Use a specialized, bootable AV rescue disk to scan the system if Safe Mode is also compromised or blocked by the malware.",
    "If the user entered credit card information into the fake payment portal, instruct them to immediately contact their bank to cancel the card and report the fraud.",
    "Verify that legitimate antivirus software is re-enabled and functioning correctly after the rogue software is removed."
  ],
  "what_to_avoid": [
    "NEVER pay for the 'license' requested by the Fake AV; it will not fix the computer, and the attackers will steal the credit card details.",
    "Do not assume the computer is clean just because the fake alerts stop; run a comprehensive scan to ensure no secondary payloads were dropped while the real AV was disabled."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}