That top Google result for a free Windows tool might be a fake - 70+ lookalike sites are handing out malware

You want a free Windows tool - say PowerToys, or CrystalDiskMark to check a drive - so you type the name into Google and click the top result. That everyday habit is being turned against people right now. Check Point Research has traced more than 70 lookalike websites impersonating popular Windows utilities, among them PowerToys, CrystalDiskMark, EasyBCD, Wintoys, Lively Wallpaper and SignalRGB. Many of the fakes rank above the genuine project pages in search results. The scheme came to light last week when the developer of one of those tools noticed a stranger's site outranking his own.

What makes this one patient and nasty is the setup. A fake site first behaves itself - its download button points at the real software, which builds trust and climbs Google's rankings. Once it's ranking well and pulling in traffic, the operators quietly swap that button for malware. A hidden script routes each visitor through a filtering layer (a "traffic distribution system") that decides who gets the clean file and who gets the payload, based on your location, browser, and whether you look like a security researcher. The malware Check Point found includes RemusStealer, which scoops up saved passwords, browser data and crypto wallets, and AnimateClipper, which silently swaps a copied wallet address for the attacker's.

The rule worth burning in: the top search result is not automatically the official site. Get free Windows apps from the Microsoft Store, or from the developer's own GitHub page or verified site - not whichever domain ranks first. If the address looks slightly off, or the file is an .exe from somewhere you don't recognise, close the tab.

Tendvane sidesteps the whole trap by installing and updating your apps through Windows' own package manager (winget), so what lands on your PC comes from a vetted source instead of a search result you had to gamble on.