Fakeoff

Overview

Rogue:Win32/Fakeoff is a deceptive class of malware known as Rogue Security Software, or 'Fake AV'. It is explicitly designed to scam victims out of money by aggressively displaying highly realistic, but entirely fabricated, security alerts and system scans. Fakeoff claims the user's computer is heavily infected with severe viruses and demands immediate payment (often via credit card) for a 'premium license' to remove the non-existent threats.

Understanding Fakeoff (Rogue AV)
To an end-user, a Fakeoff infection is terrifying and highly disruptive. The malware often takes over the entire screen, blocks access to the Task Manager, and constantly bombards the user with fake infection warnings. For a SOC analyst, Fakeoff is a social engineering attack that preys on fear. While the primary goal is financial fraud via the fake license purchase, the malware also lowers system defenses, making the machine vulnerable to actual secondary infections.

Execution and Extortion Mechanics
Fakeoff is typically distributed via drive-by downloads on compromised websites or through malicious advertisements (malvertising) (`T1189`). When executed, it installs itself deeply into the system, often modifying the Registry Run keys to ensure it starts before the Windows shell (`T1547.001`). It employs aggressive defense evasion by actively searching for and forcefully terminating the processes of legitimate antivirus software and essential system utilities like `taskmgr.exe` and `regedit.exe` (`T1562.001`). The malware then displays a fake, highly polished graphical interface mimicking a legitimate security center (`T1036`), running a fake 'scan' that guarantees finding dozens of critical threats.

Indicators of Compromise & Impact
The impact is financial loss (if the user pays) and a completely unusable system. Host-based IoCs include the inability to launch Task Manager or legitimate AV programs, EDR alerts for process termination targeting security tools, and the presence of suspicious, highly visible executable files in `%AppData%` or `%ProgramFiles%`. Network IoCs include outbound HTTP/HTTPS traffic to payment processing domains associated with the rogue software.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1036: Monitor for executable files running from unusual paths or with deceptive names. Use EDR to detect process masquerading.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_FAKEOFF_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fakeoff"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "fakeoff" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Fakeoff (Advanced Threat) Execution & Triage
id: 2d401a21-3331-52fa-ab1e-3baf793b42e3
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Fakeoff malware family. Detects proxy execution, reflective DLL loading,
  and remote command injection associated with modular enterprise backdoors.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/fakeoff
- https://malware-families-catalog.systemhelpdesk.com/defensive/backdoor-rat-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.advanced-threat
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1547_001
- attack.t1562_001
- attack.t1036
- attack.t1189
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \powershell.exe
    - \cmd.exe
    - \rundll32.exe
    - \regsvr32.exe
    CommandLine|contains:
    - DownloadString
    - IEX(
    - '/s /n /u /i:'
    - sc create
    - start-process
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: high

rule MALWARE_WIN_FAKEOFF_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fakeoff tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "fakeoff" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Boot the infected machine into Windows Safe Mode with Networking; Fake AV programs often fail to load their persistence mechanisms in Safe Mode, allowing for manual removal.
2. Use a specialized, bootable AV rescue disk to scan the system if Safe Mode is also compromised or blocked by the malware.
3. If the user entered credit card information into the fake payment portal, instruct them to immediately contact their bank to cancel the card and report the fraud.
4. Verify that legitimate antivirus software is re-enabled and functioning correctly after the rogue software is removed.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. NEVER pay for the 'license' requested by the Fake AV; it will not fix the computer, and the attackers will steal the credit card details.
2. Do not assume the computer is clean just because the fake alerts stop; run a comprehensive scan to ensure no secondary payloads were dropped while the real AV was disabled.

References & External Analysis

• Search "fakeoff" on VirusTotal (External Analysis)
• Search "fakeoff" on Any.Run (Sandbox Sandbox)
• Search "fakeoff" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Advanced Threat)

Explore other documented threats in the same operational category:

• Babar
• Globalacces
• Testfile
• Fakerean
• Mapsgory
• Easyspeedcheck
• Webisida
• Whenu

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/fakeoff.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.