{
  "family": "faketool",
  "sample_count": 20,
  "category": "trojan",
  "description": "FakeTool (cataloged under antimalware detections including Trojan:Win32/FakeTool, Rogue:Win32/FakeTool, and PUA:Win32/FakeTool) represents a pervasive family of rogue security software, fake antivirus tools, and scareware trojans. Masquerading as legitimate system defense utilities, PC repair suites, or disk defragmentation software, FakeTool is distributed through drive-by downloads, compromised websites displaying fake infection alerts, and malicious software bundlers. Upon execution, FakeTool hijacks Windows display elements and executes fabricated system scans that report non-existent virus infections, registry errors, and severe hardware failure warnings. It aggressively blocks the execution of legitimate antimalware tools and Task Manager, while coercively prompting the victim to pay for an expensive commercial activation license.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/FakeTool",
    "Rogue:Win32/FakeTool",
    "PUA:Win32/FakeTool",
    "Win32/FakeTool",
    "Program:Win32/FakeTool"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/FakeTool?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "FakeTool is a rogue security scareware trojan that displays fake virus warnings to coerce victims into buying fake licenses."
      }
    },
    {
      "@type": "Question",
      "name": "How does FakeTool impede system remediation?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It terminates or blocks legitimate antimalware programs and Task Manager, claiming they are infected."
      }
    },
    {
      "@type": "Question",
      "name": "How is FakeTool delivered to computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is delivered through malicious drive-by downloads, fake online scanner alerts, and software bundlers."
      }
    },
    {
      "@type": "Question",
      "name": "Are the infections reported by FakeTool real?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "No, all reported viruses and system errors are completely fabricated to induce panic and force payment."
      }
    },
    {
      "@type": "Question",
      "name": "How can FakeTool be eradicated from an infected system?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Boot into Windows Safe Mode, kill the rogue process, remove startup registry keys, and run a reputable antimalware scanner."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1189",
    "T1491.001",
    "T1547.001",
    "T1562.001",
    "T1112"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/FakeTool",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/FakeTool"
    },
    {
      "name": "Malwarebytes Labs - Rogue.FakeTool Removal Guide",
      "url": "https://www.malwarebytes.com/blog/detections/rogue-faketool"
    },
    {
      "name": "Sophos Threat Center - FakeTool Analysis",
      "url": "https://www.sophos.com/en-us/threat-center/threat-analyses"
    }
  ],
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1491.001",
      "name": "Defacement: Internal Defacement",
      "tactic": "Impact"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Instruct the user not to input credit card numbers into the fake registration prompt.",
    "Reboot the infected machine into Safe Mode with Networking to bypass process-killing hooks.",
    "Terminate active FakeTool processes and remove startup keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run.",
    "Clean malicious DisallowRun registry values under HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options.",
    "Run a reputable antimalware scanner to remove all leftover rogue files."
  ],
  "what_to_avoid": [
    "Do not purchase license keys from the fake software interface.",
    "Do not allow pop-up scan warnings on websites to prompt software installations."
  ],
  "target_industries": [
    "Consumer Endpoints",
    "Small Business Workstations"
  ],
  "target_geographies": [
    "Global"
  ],
  "threat_actors": [
    "Scareware Syndicates & Rogue Antivirus Affiliates"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence",
    "defense_evasion"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Financial Fraud & Scareware Licensing Fees",
  "sample_hashes": [],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}