A new malvertising campaign has been identified disguising as the legitimate Windows news portal “WindowsReport[.]com” to distribute a malicious installer for the “CPU-Z” processor tool. The campaign is noted to be a part of a large-scale malvertising campaign that has been observed targeting other applications, such as Notepad++, Citrix, and VNC Viewer. Researchers identified a malicious ad at the top of provided search results when searching for “cpu-z”, which is a common utility for Windows end-users for troubleshooting their machine. If clicked, the malicious ad redirects the user to a domain impersonating WindowsReport[.]com and uses content directly from the legitimate portal. Researchers emphasized that several additional domains are hosted on the same IP address that are also used in malvertising campaigns. The campaign’s payload is a digitally signed installer that contains a loader known as “FakeBat”. The loader contains a remote payload for “Redline Stealer” as well. CTIX analysts will continue to monitor malvertising campaigns as they continue to evolve. Indicators of compromise (IOCs) can be viewed in the report linked below.