{
  "family": "fakeoff",
  "sample_count": 4,
  "category": "advanced_threat",
  "description": "Rogue:Win32/Fakeoff is a deceptive class of malware known as Rogue Security Software, or 'Fake AV'. It is explicitly designed to scam victims out of money by aggressively displaying highly realistic, but entirely fabricated, security alerts and system scans. Fakeoff claims the user's computer is heavily infected with severe viruses and demands immediate payment (often via credit card) for a 'premium license' to remove the non-existent threats.<br><br><b>Understanding Fakeoff (Rogue AV)</b><br>To an end-user, a Fakeoff infection is terrifying and highly disruptive. The malware often takes over the entire screen, blocks access to the Task Manager, and constantly bombards the user with fake infection warnings. For a SOC analyst, Fakeoff is a social engineering attack that preys on fear. While the primary goal is financial fraud via the fake license purchase, the malware also lowers system defenses, making the machine vulnerable to actual secondary infections.<br><br><b>Execution and Extortion Mechanics</b><br>Fakeoff is typically distributed via drive-by downloads on compromised websites or through malicious advertisements (malvertising) (`T1189`). When executed, it installs itself deeply into the system, often modifying the Registry Run keys to ensure it starts before the Windows shell (`T1547.001`). It employs aggressive defense evasion by actively searching for and forcefully terminating the processes of legitimate antivirus software and essential system utilities like `taskmgr.exe` and `regedit.exe` (`T1562.001`). The malware then displays a fake, highly polished graphical interface mimicking a legitimate security center (`T1036`), running a fake 'scan' that guarantees finding dozens of critical threats.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is financial loss (if the user pays) and a completely unusable system. Host-based IoCs include the inability to launch Task Manager or legitimate AV programs, EDR alerts for process termination targeting security tools, and the presence of suspicious, highly visible executable files in `%AppData%` or `%ProgramFiles%`. Network IoCs include outbound HTTP/HTTPS traffic to payment processing domains associated with the rogue software.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1547.001",
    "T1562.001",
    "T1036",
    "T1189"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1036",
      "name": "Masquerading (Spoofing legitimate security software GUIs)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Terminating real AV)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys",
      "tactic": "Persistence"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Boot the infected machine into Windows Safe Mode with Networking; Fake AV programs often fail to load their persistence mechanisms in Safe Mode, allowing for manual removal.",
    "Use a specialized, bootable AV rescue disk to scan the system if Safe Mode is also compromised or blocked by the malware.",
    "If the user entered credit card information into the fake payment portal, instruct them to immediately contact their bank to cancel the card and report the fraud.",
    "Verify that legitimate antivirus software is re-enabled and functioning correctly after the rogue software is removed."
  ],
  "what_to_avoid": [
    "NEVER pay for the 'license' requested by the Fake AV; it will not fix the computer, and the attackers will steal the credit card details.",
    "Do not assume the computer is clean just because the fake alerts stop; run a comprehensive scan to ensure no secondary payloads were dropped while the real AV was disabled."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}