Security News Fake MAS Windows activation domain used to spread PowerShell malware BleepingComputer Daniel Bender 24 Dec 2025 A typosquatted domain impersonating the Microsoft Activation Scripts (MAS) tool was used to distribute malicious PowerShell scripts that infect Windows systems with the 'Cosmali Loader'.
