Windows users are being targeted by a new scam involving fake software updates, cybersecurity experts warn. Attackers are luring users to deceptive websites that mimic official Microsoft pages and prompt them to download what appears to be a legitimate Windows update. However, the downloaded file actually contains malicious software designed to steal sensitive information like passwords and payment details.

Malwarebytes researchers have identified the scam using fake Microsoft Support and Windows Update websites that closely resemble the real ones, including using similar fonts, colors, and designs. Users are advised to be cautious of urgent update alerts received via email, text, or notifications and to verify updates directly through Windows Update settings.

The fraudulent downloads are made to look authentic to evade suspicion from users and some security software. While the current targets seem to be primarily in France, experts warn that the scam could rapidly spread, urging all Windows users to exercise caution before downloading any updates.

To enhance security, users are advised to avoid clicking on update links from emails, texts, or social media and instead rely on Windows’ built-in update system by navigating to Settings > Windows Update and selecting “Check for updates.” Any separate download offering a Windows update should be treated with skepticism, and enabling automatic updates is recommended to minimize the risk of falling victim to fake update scams.

Specific caution is advised for Windows 11 users who receive unexpected urgent update messages, emphasizing the importance of exclusively installing software through official Microsoft channels as the best defense against such cyber threats.