What you need to know
- Windows Toolbox is advertised as a debloater for Windows 11 and 10, as well as an easy way to get the Google Play Store on Windows 11.
- It's been discovered that this helpful Toolbox utility is, in fact, a Trojan.
- The Toolbox serves its advertised functions despite the fact that it creates headaches such as redirecting web-surfing users to scam URLs.
If you've downloaded Windows Toolbox from GitHub, bad news: Turns out, it's a Trojan that's been quietly messing with your PC. Given the plethora of positive utilities the Toolbox serves, it may come as a shock that it's actually a vehicle for malware that'll redirect your URLs, hit you with unsavory Chrome extensions, and more.
The reason the Toolbox got popular was thanks to its advertised features: It shaves down the bloat of Windows 11 and 10 by getting rid of certain preinstalled apps, disabling Cortana and OneDrive, and much more. Furthermore, it sells itself as a solution for a one-click installation of the Google Play Store on Windows 11.
The kicker: Toolbox actually delivers, for the most part. The issue is that it also features PowerShell code that'll set the stage for malicious scripts to run on your device (via BleepingComputer). You can see the tool's GitHub listing here.
From there, Chromium extensions will be added without your consent, activating revenue harvesting schemes by redirecting you to unwanted promotions as well as referral and affiliate scam URLs. If you believe you've been infected, BleepingComputer has a breakdown of steps to remedy the issue, which you can see by clicking the hyperlink up above.
This isn't the only sneaky, stealth-minded Windows threat to crop up in recent memory. Tarrask malware did a noteworthy-enough job of covering its tracks to get Microsoft's attention.
