Deceptive Download Sites Use Real Hover Links to Deliver Malicious “Download Studio” Installer
What Happened — Malwarebytes identified a network of 41 malicious websites that masquerade as legitimate game and software download pages. The pages display a genuine URL (e.g., a Steam Store link) when the mouse hovers over the download button, but JavaScript intercepts the click and redirects the visitor to a malicious installer called Download Studio.
Why It Matters for Compliance & Audit Readiness
- This campaign exploits the classic “hover‑to‑verify” safety habit, highlighting the need for documented Security Awareness Training that covers modern web‑based deception techniques.
- SOC 2 CC6 (System Operations) and CC7 (Change Management) require evidence that users are trained to recognize and report suspicious download behavior, and that controls (e.g., web‑filtering, endpoint protection) are continuously monitored.
- Continuous‑compliance programs must capture training completion, phishing‑simulation results, and web‑filter logs as audit evidence to demonstrate due diligence.
Who Is Affected — Gaming communities, consumer‑software users, corporate employees who download tools for work, and any organization that permits web‑based software acquisition.
Recommended Actions
- Update your security awareness curriculum to include “hover‑link deception” scenarios and conduct regular phishing simulations that mimic this behavior.
- Enforce web‑filtering policies that block known malicious domains and inspect JavaScript redirects.
- Log and retain evidence of training, simulation outcomes, and web‑filter alerts to satisfy SOC 2 audit requirements. Source: Malwarebytes Labs
Technical Notes — The sites use JavaScript to cancel the default navigation to the displayed URL and instead route the click through an affiliate redirect to the Download Studio installer, which is known to bundle adware and potentially unwanted programs. No CVE is involved; the technique is a social‑engineering exploit of browser UI behavior. Source: Malwarebytes Labs