# Fake MAS Windows activation domain used to spread PowerShell malware

**URL:** <https://forums.thehomestack.io/t/fake-mas-windows-activation-domain-used-to-spread-powershell-malware/21633>\
**Category:** Bleeping Computer\
**Created:** [December 25, 2025, 6:08am UTC](https://forums.thehomestack.io/t/fake-mas-windows-activation-domain-used-to-spread-powershell-malware/21633 "2025-12-25T06:08:38Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![robinhood1995](https://forums.thehomestack.io/letter_avatar_proxy/v4/letter/r/48db29/32.png) [@robinhood1995](https://forums.thehomestack.io/u/robinhood1995)\
**Post date:** [December 25, 2025, 6:08am UTC](https://forums.thehomestack.io/t/fake-mas-windows-activation-domain-used-to-spread-powershell-malware/21633/1 "2025-12-25T06:08:38Z")

</div>

A typosquatted domain impersonating the Microsoft Activation Scripts (MAS) tool was used to distribute malicious&nbsp;PowerShell scripts that infect Windows systems with the ‘Cosmali Loader’. […]

* * *
This is a companion discussion topic for the original entry at [https://www.bleepingcomputer.com/news/security/fake-mas-windows-activation-domain-used-to-spread-powershell-malware/](https://www.bleepingcomputer.com/news/security/fake-mas-windows-activation-domain-used-to-spread-powershell-malware/)