Fake MAS Windows activation domain used to spread PowerShell malware