The Installer Is Signed, the Vendor Is Real, and Your AV Has No Reason to Care

Malwarebytes' threat intelligence team has documented a cluster of lookalike websites impersonating CNN, Avast and Stremio, each pushing Windows users to download a "free app" ^[1][2]. What installs is not malware in any signature sense: it is O&O Syspectr, a genuine, digitally signed remote administration tool from the German company O&O Software GmbH, generated in advance so that it reports to the attacker's account ^[3][4].

That distinction is the whole story. Syspectr is sold openly to IT departments and gives its operator remote desktop control and an admin-level command line on the machine where it runs ^[5]. In the attacker's hands that means running commands, installing further software, and going through files and data ^[6]. No exploit, no dropper, no packed payload. The victim clicks a red Download button on a page that copies CNN's layout, current headlines and a "Live Updates" tag closely enough to pass a glance, and installs an enterprise tool that happens to be enrolled to someone else ^[7][8].

The infrastructure is not sophisticated, which makes the economics worse. According to Malwarebytes, avast-premium[.]shop reproduces Avast's download page including logo and review scores behind a blue "Free download" button for "Avast One," and stremiotv[.]online copies the Stremio media-center app ^[9][10]. Every Syspectr installer carries the account ID of whoever generated it, embedded in the filename, and the CNN, Avast and Stremio files all carry the same one ^[11][12]. A second pair of sites, syncminer[.]xyz and idleminer[.]pro, drops the trusted-brand pretense entirely for an "idle miner" browser game with a ticking crypto balance and a "Download Miner Plugin" button, and ships the file under its real name with a different account ID ^[13][14][15]. So: at least four named domains plus the CNN clone, two operator accounts, one commodity tool ^[16].

Antivirus may not stop any of this, and Malwarebytes says plainly why: antivirus detects malicious software, and this is legitimately signed business software whose only sin is how it arrived ^[17]. Reputation, signing chain, vendor identity all check out, because they are real. The consumer-grade answer offered in the writeup is a ten-second check: right-click the installer, open Properties, then the Details tab, where File description and Product name identify it as O&O Syspectr with an O&O Software GmbH copyright notice ^[18]. That works because the filename can be changed by anyone redistributing the file while the embedded details cannot, since altering them would invalidate the signature ^[19].

It is a good check and it will not save a fleet. It depends on a user deciding to be suspicious at the exact moment they have already decided to install something. The enforceable version of the same insight is an allowlist: an inventory of the remote-management and remote-access products your organisation actually uses, with everything else blocked by policy rather than by verdict. Syspectr's own properties are self-declaring ^[18], which is precisely what makes it easy to name in a deny rule and hard to catch with a scanner ^[17].

What to watch: whether any additional Syspectr account IDs appear in new lures, which would indicate more than the two operators visible so far ^[11][16], and whether the same lookalike playbook is repointed at other legitimate RMM vendors. Also worth watching is whether O&O moves to restrict or revoke abused accounts, since the account, not the binary, is the part of this that an attacker cannot easily replace ^[11].