Security experts from Trend Micro are warning users who are considering not paying for Microsoft software using the well-known Windows 8 “activators.” They have managed to identify at least two websites distributing these pirated activation solutions that contain hidden malware.
The first site offers users a free Windows 8 “activator,” while the second advertises an application called “Windows 8 Activator Loader Extreme Edition 2013.”
In both cases, users who use them will find themselves with a malicious application detected by Trend Micro as HKTL_KEYGEN.
Once installed, HKTL_KEYGEN asks its victims to provide personal information and send an SMS message to a specific phone number in order to proceed with activation.
The IP addresses of the websites served by the so-called activators point to servers located in Romania and Latvia. In addition, the same IP address is used by other suspicious .ru websites, including those distributing fake versions of Instagram and Angy Birds.
