Bleeping Computer

Fake MAS Windows activation domain used to spread PowerShell malware

A typosquatted domain impersonating the Microsoft Activation Scripts (MAS) tool was used to distribute malicious PowerShell scripts that infect Windows systems with the 'Cosmali Loader'.
Khaberni

The One-Letter Trick.. A Fake Domain Spreading Malware to Activate Windows

Khaberni - Recent security reports have revealed the exploitation of a fake electronic domain, very similar to the domain of the famous Microsoft Activation Scripts (MAS) tool, to spread malware.
GIGAZINE

Fake Windows activation domains used to spread PowerShell malware

typosquatting using names that are very similar to the domains used for activation in Microsoft Activation Scripts (MAS), an open-source tool that can activate licenses for Windows and Microsoft ...