{
  "family": "microfake",
  "sample_count": 14,
  "category": "scareware",
  "description": "MicroFake (classified across antimalware engines under designations including Rogue:Win32/MicroFake and Trojan:Win32/MicroFake) is a rogue antivirus and scareware family designed to extort money from Windows users through deceptive security warnings mimicking genuine Microsoft Windows Defender alerts. Propagated through fake tech support pages, blackhat SEO redirects, and malicious advertising pop-ups, MicroFake displays simulated system crash screens (Blue Screen of Death / BSOD) and alarm banners claiming the victim's PC is compromised by spyware and banking trojans. It disables Task Manager and locks desktop interaction, directing the victim to call a fraudulent toll-free phone number or purchase an expensive bogus activation license.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Rogue:Win32/MicroFake",
    "Trojan:Win32/MicroFake",
    "Scareware:Win32/MicroFake",
    "MicroFake Scareware",
    "Win32/MicroFake"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Rogue:Win32/MicroFake?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "MicroFake is a scareware and tech support fraud trojan that displays fake Windows virus warnings to extort money from victims."
      }
    },
    {
      "@type": "Question",
      "name": "How does MicroFake mimic legitimate Windows alerts?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It displays authentic-looking dialogs, icons, and fake Blue Screen of Death (BSOD) screens copying Microsoft Windows interfaces."
      }
    },
    {
      "@type": "Question",
      "name": "How does MicroFake lock the user desktop?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It hooks keyboard combinations, disables Task Manager via registry policies, and renders an always-on-top borderless window."
      }
    },
    {
      "@type": "Question",
      "name": "How do victims get infected with MicroFake?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Via malicious website redirects, aggressive pop-up ads, and deceptive software download links."
      }
    },
    {
      "@type": "Question",
      "name": "How do you recover an infected system?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Boot Windows into Safe Mode, terminate the rogue process, delete its persistence registry keys, and run an updated antivirus scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1491",
    "T1562.001",
    "T1547.001",
    "T1112",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1491",
      "name": "Defacement (UI Manipulation via Fake Alerts)",
      "tactic": "Impact"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Blocking real AV)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Boot the infected system into 'Safe Mode with Networking'; this often bypasses the scareware's autostart mechanisms and allows legitimate tools to run.",
    "Advise the end-user NOT to pay the requested fee; the reported malware infections are fabricated to induce panic.",
    "Deploy a reputable enterprise anti-malware or adware removal tool (e.g., Malwarebytes, AdwCleaner) to locate and delete the hidden registry keys and scheduled tasks.",
    "Check for and remove any proxy settings the scareware may have configured in the browser to hijack web traffic."
  ],
  "what_to_avoid": [
    "Do not input any credit card or personal information into the software's payment portal.",
    "Avoid ignoring the incident; if the user fell for the lure to install this, they may have unknowingly installed more severe malware (like a banking trojan) from the same source."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Rogue:Win32/MicroFake",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Rogue:Win32/MicroFake"
    },
    {
      "name": "Malwarebytes Labs - Tech Support Scams and Rogue Software",
      "url": "https://www.malwarebytes.com/blog/detections/rogue-microfake"
    },
    {
      "name": "MITRE ATT&CK - Defacement: Displaying Fake Security Alerts (T1491)",
      "url": "https://attack.mitre.org/techniques/T1491/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}