Hackers have taken advantage of the release of the newest Windows upgrade, Windows 11, by creating phishing sites hosting a malicious download. The operators of the campaign have begun poisoning search results to advertise a website that is similar to Microsoft’s official Windows 11 promotional page. The hosted malware can only be downloaded through a direct connection to the website and will block the user if they are using TOR or a VPN. This info-stealing malware, dubbed “Inno Stealer,” does not appear to have any code similarities to other similar viruses distributed on underground forums. The download file is a .iso, which is typical for operating system installs. Inside the ISO file is an executable named “Windows 11 setup” that launches the setup process for the malware. The malicious program is launched in a new process which then establishes persistence and plants the stealer binary onto the machine. Persistence is achieved by creating a shortcut file in the startup directory, causing Inno Stealer to run when the user logs in to their account. The final part of the malware steals user data from the Desktop, exfiltrates web browser data, and searches for cryptocurrency wallets. The malware uses a multi-threading model to implement these features, allowing all of these functions to happen simultaneously. Interestingly, Inno Stealer can also download additional payloads, but only at night. This is most likely taking advantage of the victim not using the computer during this time. CTIX analysts recommend users ensure they are only downloading operating system updates from Microsoft through Windows Update or other official methods.