You update Windows because it asks you to. Click, wait, done. It’s one of the few IT habits nobody has to be trained on, because it feels safe by default.

In April 2026, that habit is exactly what a new attack is counting on.

A fake Windows 11 update started circulating that looks close enough to the real thing to fool most people, and close enough to fool most antivirus software too. According to security firm Malwarebytes, the fake update was hosted on a typosquatted domain, microsoft-update[.]support, styled to look like an official Microsoft page. It offered a cumulative update for Windows 11 24H2, complete with a believable KB article number and a big blue download button. Click it, and you’re not installing an update. You’re installing malware built to steal passwords.

It’s not a sloppy fake

Older scams like this were easy to spot. Bad grammar, a slightly wrong logo, a URL that didn’t quite match. This one isn’t that.

The malicious file was built using WiX Toolset, a legitimate open source tool that real developers use to package real Windows software every day. The installer is even labeled to match. Its author field reads Microsoft. Its title reads Installation Database. At a glance, and even at a fairly close glance, it looks like the genuine article.

Here’s the part that should get your attention. When Malwarebytes ran the file through VirusTotal, a service that checks a file against dozens of antivirus engines at once, it came back with zero detections across 69 of them. Not one flagged it as a threat. The reason is that the malicious code sits hidden inside an Electron shell, a common framework used to build legitimate desktop apps. Antivirus tools check the outer shell, see a familiar and legitimate framework, and wave it through. They never look at what’s packed inside.

Think of it like a guard checking IDs at the door. This one showed up with a real ID borrowed from a framework everyone recognizes, carrying something dangerous in a bag nobody thought to open.

Why this matters more for a business than a home user

A password stolen from your personal laptop is bad. A password stolen from someone on your team is worse, because that password is rarely just theirs. It might open your email, your accounting software, a client portal, or a shared drive with everyone else’s files on it.

Credential theft is usually not the end of an attack. It’s the beginning of one. Once an attacker has a working password, they can log into whatever that password protects, often without tripping any alarm, because as far as your systems are concerned, that’s just an employee logging in. From there it becomes a business email compromise, a fraudulent wire request, or a foothold into other accounts that reuse the same password.

This particular fake update is effective precisely because it targets the moment your team is least suspicious. Nobody double checks a Windows update. That’s the whole point of it looking routine.

What to do about it

Keep updates inside Windows. If you’re running Windows 11, the safest way to check for and install updates is through the built in Settings app, not a page someone linked in an email or a search result. If you genuinely need to grab something manually, go directly to support.microsoft.com and nowhere else.

It’s also worth tightening who can install software on company machines in the first place. If an employee doesn’t have local admin rights, a fake installer like this one has nowhere to run even if someone clicks it. That’s a bigger lever than any single antivirus update.

Treat multi-factor authentication, or MFA, as the backstop, not the extra step. This attack exists specifically to harvest a password. If a stolen password alone isn’t enough to get into an account, the whole scheme is a lot less useful to whoever is running it.

Antivirus caught none of this. That’s not an argument against antivirus, it’s an argument for layering something behind it: fewer people with the keys to install software, and a second factor standing behind every password. Click, wait, done still works fine, as long as the click happens inside Windows Update and not on a page some stranger sent you a link to. If you want help reviewing where your team stands on admin rights or MFA, we’re happy to take a look.