Cosmali Loader Malware — Analysis, Campaigns & Threat Activity

Overview

Cosmali Loader is a Windows-based malware loader that delivers PowerShell-based payloads. Recent reports describe campaigns using fake Windows activation domains to host or spread its components, indicating its role in PowerShell-driven infection chains and lure-based delivery.

Related Threat Clusters

• Typosquatted Domains Spread Cosmali Loader via PowerShell Malware

  Users of the Microsoft Activation Scripts (MAS) tool have reported receiving pop-up warnings about a Cosmali Loader infection after mistakenly entering a typosquatted domain. The malicious domain 'get.activate[.]win'…

  2 articles · Updated December 26, 2025

Recent Intelligence Reports

• Fake Windows activation domains used to spread PowerShell malware — Gigazine · December 26, 2025
• Fake MAS Windows activation domain used to spread PowerShell malware — Bleepingcomputer · December 24, 2025

Related Entities