Fakeoff

Overview

Rogue:Win32/Fakeoff is a deceptive class of malware known as Rogue Security Software, or 'Fake AV'. It is explicitly designed to scam victims out of money by aggressively displaying highly realistic, but entirely fabricated, security alerts and system scans. Fakeoff claims the user's computer is heavily infected with severe viruses and demands immediate payment (often via credit card) for a 'premium license' to remove the non-existent threats.

Understanding Fakeoff (Rogue AV)
To an end-user, a Fakeoff infection is terrifying and highly disruptive. The malware often takes over the entire screen, blocks access to the Task Manager, and constantly bombards the user with fake infection warnings. For a SOC analyst, Fakeoff is a social engineering attack that preys on fear. While the primary goal is financial fraud via the fake license purchase, the malware also lowers system defenses, making the machine vulnerable to actual secondary infections.

Execution and Extortion Mechanics
Fakeoff is typically distributed via drive-by downloads on compromised websites or through malicious advertisements (malvertising) (`T1189`). When executed, it installs itself deeply into the system, often modifying the Registry Run keys to ensure it starts before the Windows shell (`T1547.001`). It employs aggressive defense evasion by actively searching for and forcefully terminating the processes of legitimate antivirus software and essential system utilities like `taskmgr.exe` and `regedit.exe` (`T1562.001`). The malware then displays a fake, highly polished graphical interface mimicking a legitimate security center (`T1036`), running a fake 'scan' that guarantees finding dozens of critical threats.

Indicators of Compromise & Impact
The impact is financial loss (if the user pays) and a completely unusable system. Host-based IoCs include the inability to launch Task Manager or legitimate AV programs, EDR alerts for process termination targeting security tools, and the presence of suspicious, highly visible executable files in `%AppData%` or `%ProgramFiles%`. Network IoCs include outbound HTTP/HTTPS traffic to payment processing domains associated with the rogue software.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1036: Monitor for executable files running from unusual paths or with deceptive names. Use EDR to detect process masquerading.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_FAKEOFF {
    meta:
        description = "Detects Fakeoff (advanced_threat)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "fakeoff" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Fakeoff Activity
id: 0ef44c09110e2403257dcd5b734bf574
status: experimental
description: Detects generic indicators of the fakeoff malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*fakeoff*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Boot the infected machine into Windows Safe Mode with Networking; Fake AV programs often fail to load their persistence mechanisms in Safe Mode, allowing for manual removal.
2. Use a specialized, bootable AV rescue disk to scan the system if Safe Mode is also compromised or blocked by the malware.
3. If the user entered credit card information into the fake payment portal, instruct them to immediately contact their bank to cancel the card and report the fraud.
4. Verify that legitimate antivirus software is re-enabled and functioning correctly after the rogue software is removed.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. NEVER pay for the 'license' requested by the Fake AV; it will not fix the computer, and the attackers will steal the credit card details.
2. Do not assume the computer is clean just because the fake alerts stop; run a comprehensive scan to ensure no secondary payloads were dropped while the real AV was disabled.

References & External Analysis

• Search "fakeoff" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: advanced_threat)

Explore other malware families in the same category:

• Eorezo
• Addlyrics
• Asktoolbar
• Tsingsoft
• Jawego

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/fakeoff.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.