Fake MAS Windows activation domain used to spread PowerShell malware

A typosquatted domain (get.activate.win) impersonating the MAS activation endpoint was used to serve malicious PowerShell that installs the Cosmali Loader, which researchers say delivered cryptomining utilities and the XWorm RAT; affected users reported popup warnings and project maintainers urged caution and verification of activation commands to avoid fetching payloads from look-alike domains.