We are looking for video editing software, we type the name into Google, and the first result looks like the official site. The domain is almost identical, the “Download” button is clearly visible. Except that the installed file carries an infostealer that siphons off the saved passwords in the browser. This scenario has multiplied in recent months, with dozens of fake sites imitating Windows download pages appearing prominently in search results.
Downloading software safely is not just about “avoiding shady sites.” Deceptive techniques have evolved, and the native protections of operating systems have too. Here’s how we can structure our reflexes to minimize risks as much as possible.
Fake download sites: a threat targeting Google results
By mid-2026, several analyses documented a wave of fake sites imitating Windows tool download pages. These fraudulent sites replicate the graphic charter of publishers, use almost identical domain names (one letter more, a misplaced hyphen), and manage to position themselves among the top sponsored or organic results on Google.
The offered file installs malware disguised as a legitimate installer. The user sees nothing unusual during the installation. The expected program works, but a second process runs in the background to collect data.
The basic reflex remains to check the exact domain before clicking. For software like VLC, the only reliable domain is videolan.org. For 7-Zip, it is 7-zip.org. Any variant (vlc-download.com, 7zip-free.net) should raise alarms. Additionally, one can check what FileCR is according to Pixel 23 to identify a download platform whose files are verified before publication.
Digital signature and SHA-256 hash: verify a file before executing it
Downloading from the right site is not always enough. A server can be compromised, a browser extension can alter a download. Two complementary checks ensure that the received file is indeed the one published by the publisher.
The digital signature of the executable
On Windows, a right-click on the .exe file then “Properties” > “Digital Signatures” displays the name of the publisher who signed the program. If the signature is absent or if the name does not match the expected publisher, do not launch the installation.
A valid signature confirms that the file has not been modified since its publication. This is the first line of defense, and it takes ten seconds.
The SHA-256 hash to compare the fingerprint
Some publishers publish the SHA-256 hash of their files on their site. You can generate the hash of the downloaded file using the command certutil -hashfile on Windows, then compare the two strings. If they do not match, the file has been altered.
This verification is particularly useful when downloading software from a mirror or third-party platform. It is a technical gesture that takes a minute but eliminates any doubt about the integrity of the file.
Smart App Control and SmartScreen: native Windows protections to know
Windows 11 has strengthened its filtering mechanisms with two complementary tools that most download guides do not mention.
Smart App Control blocks unsigned or unknown executables before they even install. On a compatible PC, this feature operates in evaluation mode initially, then activates automatically if the machine’s usage allows it. It provides an additional safety net for users who regularly download software.
SmartScreen, on the other hand, analyzes the reputation of downloaded files. A point often misunderstood: even a properly signed software can trigger the “unrecognized application” warning if it is new or downloaded infrequently. Microsoft does not provide a public timeline for lifting this warning, and there is no self-service procedure for publishers who want to expedite the process.
In practice, if SmartScreen displays a warning about software downloaded from the official site and whose digital signature is valid, it is reasonable to proceed. However, if the file comes from a third-party site and is not signed, the warning should be taken seriously.
Package managers and reliable platforms: automate safe downloads
Manually checking each file works, but we can also structure our installations to reduce the chances of error. Several approaches complement each other.
- WinGet, the package manager integrated into Windows, allows you to install software with a single command (winget install vlc, for example). The packages come from verified repositories, eliminating the risk of landing on a fake site via a search engine.
- Ninite groups common software (browsers, players, utilities) into a single installer that rejects toolbars and additional software. You select what you want, download a single file, and everything installs cleanly.
- The Microsoft Store remains an option for software available there. Applications are subject to verification, although feedback varies on the rigor of this control for certain categories of tools.
These three methods share a common point: they eliminate the step where the user searches for a download link in a search engine, which is precisely when the risk of landing on a fake site is highest.
Checklist before installing downloaded software
Before double-clicking on an installer, a quick four-point check is enough to filter out the majority of threats.
- Does the file come from the official site of the publisher, a package manager, or a recognized download platform?
- Is the digital signature present and does it match the expected publisher?
- Does the SHA-256 hash of the file match the one published by the publisher (when available)?
- Do SmartScreen or Smart App Control signal a problem, and if so, does the context justify overriding it?
None of these points take more than a minute. Combined, they cover the most common compromise scenarios, from a well-ranked fake site to a file altered in transit.
Secure downloading relies less on a miraculous antivirus than on a chain of simple checks applied systematically. The domain, the signature, the hash, the Windows reputation: four filters that, when put together, make attempts to infect with malicious software largely ineffective.
