The first result isn’t always the real one
Your bookkeeper needs QuickBooks on a new laptop. She opens Chrome, types quickbooks download, and clicks the top result. It looks right. Same logo, same shade of blue, and the web address is close enough that nobody blinks. The installer runs, QuickBooks actually opens, and the day moves on.
Except that installer dropped something else on the way in. Twenty minutes later every password saved in her browser, every active login session, and the cookie for your business banking portal are sitting on a server in another country.
That’s malvertising. Criminals buy search ads for software that people download all the time, then send the clicks to a fake download page. Google collects the ad money. You collect the malware.
Why this one works so well
We’ve spent fifteen years telling people to watch out for sketchy emails. Nobody trained anyone to distrust a search engine. If you type a product name and the answer appears at the top of the page, your brain files it under safe before you’ve even read the URL.
The fake pages are good now, too. Not the broken-English, three-different-fonts stuff from 2015. These are pixel copies of the real vendor site, sometimes hosted on a domain that was registered that morning specifically so no security tool has flagged it yet. And the software usually works. That’s the part people miss. The real program installs and runs perfectly, which is exactly why nobody suspects anything for weeks.
The software they fake most
- Remote access tools. AnyDesk, TeamViewer, and similar. A fake version gives an attacker a legitimate-looking way back into your machine.
- Accounting and tax software. QuickBooks, TurboTax, anything that lives near your money.
- Browsers and PDF tools. Chrome, Firefox, Adobe Reader. Boring downloads nobody thinks twice about.
- Free utilities. File converters, video downloaders, WinRAR, Notepad++. The stuff employees grab on their own without asking IT.
- Crypto and trading apps. Straight cash grab.
What actually gets stolen
The payload is almost always an infostealer. It’s a small program with one job: sweep the machine for anything valuable and ship it out fast. That means saved browser passwords, autofill data including card numbers, cryptocurrency wallets, VPN configs, and session cookies.
Those cookies matter more than the passwords. A stolen session cookie lets somebody log into your Microsoft 365 as your employee without a password and without triggering an MFA prompt, because as far as the system knows, that person already proved who they were. We’ve written about that trick before and it keeps showing up in real incidents.
The whole thing takes under a minute. By the time the laptop is scanned, the data is long gone and the stealer has often deleted itself.
Why your antivirus missed it
Two reasons. First, the download came from a site the user visited on purpose, which is about as trusted as a file gets. Second, a lot of these installers are packaged fresh for each campaign, so the file signature has never been seen before and there’s nothing to match against.
Traditional antivirus asks, have I seen this exact bad thing before? Modern attacks are built specifically to answer no.
How to shut this down
You don’t need a giant security budget for this one. You need a few boring habits and two or three technical controls.
1. Bookmark the vendors you use
Every piece of software your business depends on should have a bookmark in the browser, pointed at the real vendor domain. Nobody should ever search for a download they already have a source for. This costs you twenty minutes once.
2. Block ads at the network level
An ad blocker is a security tool, not a convenience. Blocking at the DNS layer stops the malicious ad from loading at all, which means the employee never sees the bait. I run a small box at my own house that does this for every device on the network, phones included, and it eats thousands of requests a day without anyone noticing it’s there.
3. Take away the ability to install software
If your staff can’t install programs on their work machines, this entire attack class dies at the last step. The user clicks, downloads, double-clicks, and Windows says no. Then they call you and you install the real thing from the real source. Most small offices give everybody full admin rights on day one and never revisit it. That single setting is doing more damage than any firewall is preventing.
4. Teach the URL check
One habit: before you download anything, read the address bar out loud. Not the page. The address bar. If it says quickbooks-download-official dot net instead of intuit dot com, you’re done. Ten seconds.
5. Assume it already happened once
If you think a machine got hit, changing the password is not enough. You have to invalidate active sessions too, or the attacker keeps walking in through the cookie they already stole. In Microsoft 365 that means revoking sessions for the account, not just resetting the password.
What this looks like when it’s handled
For the clients we manage in Delray Beach and West Palm, this is mostly invisible. Ad and malware domains get blocked before the browser loads them. Staff machines don’t have install rights. Software gets pushed out from a central console, so nobody’s out there hunting for installers in the first place. When something new does need to go on a laptop, it takes us about five minutes.
The version where you find out three weeks later that your bank login was sold to somebody takes a lot longer than five minutes.
Do this today
Open a laptop in your office. Try to install something. If it just works with no password prompt, you’ve found your first project. Then bookmark your five most-used software vendors and tell your team to stop searching for downloads.
If you want somebody to look at the whole picture instead of one laptop, that’s what we do. Reach out and we’ll walk your setup with you. Always happy to troubleshoot.