Phantom Installer Lab

On 6 July 2026, user Tarek was setting up a new workstation and downloaded several common software installers. He recalls that none of the installations caused any visible issues, but later that day all of his files were wiped. We suspect the user fell victim to SEO poisoning that led to downloading and running a trojanized installer, ultimately resulting in a destructive wiper payload.