If you're interested in upgrading to Windows 11, here are some tips to avoid being scammed or infected with malware

If you've recently received an email recommending that you upgrade to Windows 12, you probably had enough spidey-sense to delete it. You should realize this is a fake or a come-on for some piece of malware that was about to infect your computer. But what about if you got a message asking you to upgrade to Windows 11? Security researchers have tracked a malicious campaign that made use of a legitimate-sounding “windows-upgraded” domain (don’t worry, it has been neutralized since) which was used to spread RedLine Stealer malware by running a fake installer. 

Fake installers are nothing new — we wrote about one of them last April and had several suggestions on how to spot and avoid them. Mobile apps are rife with this exploit because we generally don’t vet these apps as well as we should. We wrote about some of these mobile attacks, touching on hiding complex URL strings and a class of particularly pernicious threats called homograph attacks. This takes typosquatting — what the RedLine Stealer folks above were doing by registering their domain — to a new level of nastiness by substituting non-Roman alphabets that look similar.

So if you are interested in upgrading to Windows 11, here are some tips to avoid being scammed or infected with malware (or both):

First, always get your download directly from Microsoft (or a reseller that you have previously done business with). This is the official Microsoft download page.

Second, trust your instincts. If something appears odd, such as the “Windows 12” upgrade, skip it. If you get a warning from Windows or your phone about a planned download, stop and review it carefully — it's probably popping up for a reason. Alternatively, if your installer is offering you multiple apps that you didn’t intend to obtain, stop it immediately. If you're installing a new app, take the time to read the permissions requested by it, while ensuring that you understand what the app wants to do and that it's appropriate. (Android apps are particularly vulnerable to fakery, as this recent report mentions.)

Finally, is the offer just too good to pass up? If it looks too good to be true, then it likely is. This is good advice in general for anything delivered to your inbox or phone.