Khaberni

The One-Letter Trick.. A Fake Domain Spreading Malware to Activate Windows

Khaberni - Recent security reports have revealed the exploitation of a fake electronic domain, very similar to the domain of the famous Microsoft Activation Scripts (MAS) tool, to spread malware.
Bleeping Computer

Fake MAS Windows activation domain used to spread PowerShell malware

A typosquatted domain impersonating the Microsoft Activation Scripts (MAS) tool was used to distribute malicious PowerShell scripts that infect Windows systems with the 'Cosmali Loader'.