{
  "family": "fakesmoke",
  "sample_count": 3,
  "category": "trojan",
  "description": "Trojan:Win32/Fakesmoke is a form of **Rogue Security Software** (often called Fake AV or Scareware). It masquerades as a legitimate, high-end antivirus program, deliberately generating terrifying, fake security alerts to trick the user into paying for a 'premium' license to remove non-existent threats.<br><br><b>Understanding Fakesmoke</b><br>To an end-user, Fakesmoke is highly distressing. The desktop is bombarded with urgent, red-flashing pop-ups claiming the system is severely infected with zero-day trojans or that data is actively being stolen. For a security team, Fakesmoke relies entirely on social engineering and intimidation (`T1498.002` - modified context for deception) to monetize the infection directly from the victim.<br><br><b>Execution and Scareware Mechanics</b><br>Fakesmoke is often distributed via malvertising, drive-by downloads, or bundled with pirated software (`T1189`). Upon execution (`T1204.002`), it establishes persistence via the Registry (`T1547.001`) so it runs every time the computer boots. It immediately displays a highly professional-looking (but fake) scanning interface. It simulates a fast scan and inevitably reports dozens of severe infections. To enforce compliance, Fakesmoke actively attempts to disable legitimate Windows utilities (like Task Manager, Registry Editor, and Command Prompt) (`T1562.001`) and may block access to real security vendor websites to prevent the user from downloading actual removal tools.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is primarily financial fraud and severe disruption of productivity. Host-based IoCs include EDR alerts for the unauthorized modification of registry keys disabling Task Manager (`HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr`), the presence of the rogue executable in the `%AppData%` folder (often with a randomly generated, innocent-sounding name), and persistent, aggressive pop-up windows demanding credit card payment.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1562.001",
    "T1498",
    "T1547.001",
    "T1189"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Disabling Task Manager/AV)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1498",
      "name": "Network Denial of Service (Blocking access to security sites)",
      "tactic": "Impact"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution",
      "tactic": "Persistence"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Boot the infected machine into 'Safe Mode with Networking' to prevent the Fakesmoke persistence mechanisms from launching and blocking remediation tools.",
    "Use the Registry Editor to manually re-enable Task Manager and Command Prompt if they were disabled by the malware.",
    "Run a full system scan using a known, trusted, enterprise-grade anti-malware solution to detect and remove the rogue executable.",
    "Educate the user on the deceptive tactics of rogue security software and instruct them to contact their credit card company if they made a payment."
  ],
  "what_to_avoid": [
    "Do not input any personal or financial information into the payment portals presented by the software.",
    "Avoid attempting to manually delete the Fakesmoke files in normal Windows mode, as the malware will actively defend itself and block deletion."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}