massgravel.dev Typosquatting Warning: What to Do If You Ran a Fake MAS PowerShell Command

What the record actually shows​

The report comes from security publisher 2-Spyware. Its data says abuse.ch's URLhaus lists three URLs on massgravel.dev as reported malware downloads. 2-Spyware puts the latest report at about 06:06 UTC on September 15, 2026, and says none of the three was marked online in its copy of the data.

2-Spyware's RDAP lookup says the domain was registered on August 30, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. That would put the first reports within roughly two weeks of registration. The public record names no owner. The listed statuses are client hold, client delete prohibited and client transfer prohibited.

On October 23, 2026, 2-Spyware made one plain server request and got a name-not-found error. It attributes this to the client hold, which takes a name out of DNS. 2-Spyware did not open the domain in a browser and did not download anything.

These are 2-Spyware's account of the records. They are not an independent check against URLhaus.

What nobody knows​

• The payload. The file addresses, file names, tags and malware family were not in 2-Spyware's data. It cannot say whether the files were scripts, installers or documents.
• The operator. The registration record does not identify who controls the domain.
• The intent. The name looks like a typo trap, but 2-Spyware says it found no source proving the operator meant to imitate MAS. Treat the resemblance as a strong hint, not proof.
• The hold. A hold can come from a complaint, a billing problem or unverified contact details. Holds can be lifted, and an operator can register another name.

A failed lookup today says nothing about a PC that ran something from the domain in September. The reverse also holds: a URLhaus listing does not show that any particular PC was infected.

Why the lookalike matters​

According to 2-Spyware, the official MAS install command uses activated.win, not massgravel.dev. It also says the project warns that third parties alter the URL in the PowerShell command to spread malware. I could not retrieve the project page directly, so treat both points as reported rather than independently confirmed.

The technique itself is documented. BleepingComputer reported that a typosquatted domain impersonating MAS distributed malicious PowerShell scripts that infected Windows systems with the "Cosmali Loader". That lookalike domain differed from the legitimate one by a single character, and the attackers bet on users mistyping it. Security researcher RussianPanda told BleepingComputer that Cosmali Loader delivered cryptomining utilities and the XWorm remote access trojan.

Nothing links that campaign to massgravel.dev. It shows only that this kind of attack works, not what massgravel.dev served.

Who should worry​

• You only saw the name in a log, a search result or a warning. That alone proves nothing, and you are not infected by it.
• You typed or pasted a command containing the name, or you can't tell what address your command used. Treat the PC as possibly compromised.

To find the command, open PowerShell and press the Up arrow, or check the post you copied it from. Compare the domain letter by letter with activated.win. Don't visit massgravel.dev to test it.

What to do if you ran it​

The order matters, because a compromised PC can capture whatever you type on it.

1. Change passwords from a different, trusted device, starting with your email account. Sign out other sessions, check recovery details and forwarding rules, and enable two-step verification. This is precautionary. Nothing shows that this domain stole credentials.
2. Check Protection history. In Windows Security, go to Virus & threat protection > Protection history and look for detections around the time you ran the command.
3. Run a Microsoft Defender Offline scan. Microsoft's documentation, which applies to Windows 10 and 11, says to open Virus & threat protection > Scan options and choose Microsoft Defender Antivirus (offline scan). The scan runs after a restart, without loading Windows, so persistent malware has a harder time hiding or defending itself. Save your work first, because it restarts the PC. Results appear under Protection history.
4. Look for leftovers. Check Task Scheduler, Startup apps in Task Manager, and Settings > Apps > Installed apps for entries you didn't create. Note them before deleting anything. These are supplementary checks. A clean result doesn't clear the PC.
5. If in doubt, wipe. Microsoft's recovery guidance says that for suspected malware that survives a scan, you can reinstall Windows from installation media and choose the clean-install option. That removes Windows, personal files, apps and settings from the selected drive. Reset this PC is the lighter option, and it lets you keep or remove personal files.

Back up only documents and photos, not programs. Keep your BitLocker recovery key handy if BitLocker is on. Managed work or school PCs should go to IT, which Microsoft's guidance also recommends.

ThaiCERT's advisory on the earlier fake-MAS campaign said the most reliable remediation is a full wipe and reinstall of Windows. That advisory concerned the Cosmali Loader campaign, not massgravel.dev. It does show why wiping is a sensible fallback when you can't identify the payload.

The takeaway​

The evidence for massgravel.dev is three URLhaus reports and one failed lookup. That is enough to justify caution, but not to name a payload, an operator or a motive. The lasting lesson is about habit. Piping a remote script into PowerShell means trusting every character of the address, so read it letter by letter, or skip the shortcut and buy a licence.