Fake updates of Windows 10 began to be used to distribute the Magniber hijacker program. Ordinary PC users are at risk.

BleepingComputer writes that in the past few days it has received many requests for help in connection with the infection of blackmail programs around the world. Fake updates are distributed under different names, the most common being Win10.0_System_Upgrade_Software.msi VirusTotal and Security_Upgrade_Software_Win10.0.msi.

Once uploaded, the requestor encrypts the files. When encrypting, it adds a random 8-character extension like .gtearevf as shown below. The program also creates a notebook named README.html in each folder. It contains instructions on how to pay the ransom. The hijackers want $2,500 or 0.068 bitcoins.

Experts said the campaign is primarily aimed at students and ordinary users, not the company.