Fake download
In plain terms
On a download page, several big "Download" buttons. Only one is the real one, and it's neither the most visible nor the first.
Definition
A fake download is the substitution of a malicious program for the expected file, either through a misleading button on a download page, or through an installer that adds unrequested software.
How it works
Sites that host files fund their activity through advertising, and the ads there take the form of a download button, because that's what the visitor is looking for. The real link then ends up smaller, lower down, or as plain text. A second variant doesn't mislead on the button but on the content: the installer does download the intended software, while adding browser extensions, a modified search engine, or an unrequested utility, with each install screen designed so that "Next" counts as acceptance. A third targets paid software offered for free, where the file provided is something else entirely.
Warning signs
- Several "Download" buttons on the same page, of different sizes
- File whose name or size doesn't match the expected software
- Installer offering pre-checked options for unrelated software
- File extension different from the one expected for this type of program
- Download going through a third-party site rather than the publisher
- Browser or antivirus warning that you're being urged to ignore
How to verify
Check the domain the download comes from, not the button's appearance: it should be the publisher's. During installation, read every screen and uncheck anything you didn't ask for. Being invited to disable a protection to finish an installation is reason enough to stop.
What to do
Go through the publisher's site or an official app store, and avoid download aggregator sites. On an unfamiliar page, prefer the plain link over the flashy button — the visual hierarchy there is deliberately reversed.
If it already happened
Uninstall the program, then check what's most often changed on this occasion: browser extensions, default search engine, home page, programs launched at startup. Run a full scan, then change your passwords from another device starting with email.
Frequently asked questions
- How do I recognize the right button?
- Don't try to recognize it: hover over it and read the domain it points to. The real download comes from the publisher's domain. On that criterion, the button's size and color no longer matter.
- I installed software that added things I didn't want.
- Uninstall them one by one, then check your browser extensions and default search engine, which these installers modify first. If behavior persists after uninstalling, have the machine scanned.
Related attacks
Official sources
This article is part of the Website and browser attacks family. Last updated: 2026-09-02.