Last year I nearly wiped a client's development laptop because I downloaded what looked like the official installer for a popular open-source PDF tool. The download page was a near-perfect clone, right down to the logo and the version number. The only tell was a domain that read get-tool-app[.]com instead of the project's real address. The installer ran fine, opened the app, and quietly dropped a cryptominer that pinned the CPU at 98% for three days before anyone noticed.
I'm not alone. Sophos and Google's Threat Analysis Group have both documented a sharp rise in "malvertising" campaigns that buy search ads for terms like "download Notepad++" or "OBS Studio official" and outrank the genuine project. One 2023 study found that a meaningful slice of top search results for popular software downloads pointed to trojanized copies. The installers work. The malware is invisible. And the only defense is knowing how to verify software downloads before you double-click.
This guide walks through exactly how professionals check that an installer is genuine: verifying checksums, validating digital signatures, reading download URLs like a security analyst, and sandboxing anything you're unsure about. By the end you'll have a repeatable routine that takes about 90 seconds per download and catches the overwhelming majority of fakes.
Key Takeaways
- Always download from the source of truth — the official project site or a reputable marketplace, never a search ad or a "download mirror" you found via Google.
- Verify the checksum (SHA-256) against the value published by the vendor. A one-character mismatch means the file is not what it claims to be.
- Check the digital signature on Windows and macOS. An unsigned or wrongly-signed installer is a red flag on commercial software.
- Read the URL and TLS certificate. Typosquatted domains and freshly registered sites are the number one delivery method for fake installers.
- Sandbox anything suspicious in a VM or with a service like VirusTotal before it touches your real machine.
Why fake installers are more dangerous than ever
The old advice — "just download from the official site" — assumes you can reliably find the official site. That assumption broke somewhere around 2022 when attackers started outbidding legitimate vendors on search ads and cloning download pages pixel for pixel.
A modern fake installer usually does three things at once:
- Delivers the real software so nothing looks broken and you don't get suspicious.
- Drops a payload — an info-stealer, a remote access trojan, or a cryptominer — that runs silently in the background.
- Establishes persistence so it survives reboots and the eventual uninstall of the "app" you thought you wanted.
The payloads have gotten nastier too. Info-stealers like RedLine and Lumma grab browser-saved passwords, session cookies, and crypto wallet files in seconds. That's why I've written before about what the research reveals about password manager security and how protecting your synced credentials matters — a single trojanized installer can undo months of good password hygiene.
Start at the source: where you download matters most
Verification starts before you download anything. The single highest-impact habit is controlling where the file comes from.
Rank your sources by trust
- The vendor's official domain, reached by typing the address directly or via a bookmark — not by clicking a search result.
- A reputable, curated marketplace that vets what it lists. When I buy commercial tools I prefer a marketplace where a human has actually reviewed the product, like the catalog at LionScripts, because there's accountability behind each listing.
- The vendor's official GitHub releases page (check that the repository is the real one, with the expected star count and contributor history).
- Everything else — mirrors, "download aggregator" sites, torrent links, and search ads — should be treated as hostile until proven otherwise.
The search-ad trap
Here's the scenario that trips up even experienced developers. You search "download 7-Zip". The first result is a sponsored ad. It looks official. You click, land on a clone, and download a poisoned installer.
The fix is almost embarrassingly simple: scroll past the ads. Better yet, learn the canonical domain for the tools you use and bookmark them. For the free utilities I rely on I keep a text file of official URLs so I never have to search. When you're evaluating paid or niche software, browsing by software category on a trusted marketplace also sidesteps the search-ad minefield entirely.
How to verify a checksum (the 60-second habit)
A checksum, or hash, is a fixed-length fingerprint of a file. Change a single byte and the entire hash changes. Vendors publish the SHA-256 hash of their genuine installer so you can confirm the file you downloaded is byte-for-byte identical.
Worked example: verifying a 78 MB installer
Say you've downloaded MyTool-Setup-v4.2.1.exe, a 78 MB file, and the vendor's page lists this SHA-256:
a3f5c9e2...d41b7 (64 hex characters)
On Windows, open PowerShell in the download folder and run:
Get-FileHash .\MyTool-Setup-v4.2.1.exe -Algorithm SHA256
On macOS or Linux, run:
shasum -a 256 MyTool-Setup-v4.2.1.exe
Compare the output to the published hash. If it matches character-for-character, the file is genuine. If it differs by even one character, delete it immediately and do not run it.
Common checksum mistakes
- Comparing the wrong algorithm. MD5 and SHA-1 are both broken for security purposes. If a vendor only offers MD5, treat it as a weak signal, not proof.
- Trusting a hash from the same page that hosts the file. If an attacker controls the download page, they control the listed hash too. Cross-check the hash against a second source when possible — the vendor's GitHub, their signed release notes, or a mailing list announcement.
- Eyeballing instead of comparing. Copy both values into a text editor and use find-and-replace, or paste them into a diff tool. Human eyes skip over transposed characters.
Digital signatures: proof of who built the file
A checksum tells you the file wasn't altered. A digital signature tells you who signed it. For commercial software this is your strongest single check, because a valid signature is expensive to fake.
Verifying signatures on Windows
- Right-click the
.exeand choose Properties. - Open the Digital Signatures tab. If there's no such tab, the file is unsigned — a serious warning sign for paid software.
- Select the signature and click Details. Confirm the signer's name matches the company you expect.
- Click View Certificate and check the certificate chain is valid and not expired or revoked.
Verifying signatures on macOS
Open Terminal and run:
codesign -dv --verbose=4 /Applications/MyTool.app
Look for the Authority line naming a Developer ID, and run spctl -a -vv /Applications/MyTool.app to confirm Gatekeeper accepts it. A result of "rejected" means the notarization or signature failed.
Read the URL like an analyst
Most fake-installer attacks succeed at the URL stage, before any file is even downloaded. Train yourself to read a web address the way a proofreader reads a headline.
Red flags in a download URL
- Typosquats:
notpad-plus.org,obsstudi0.com,vlc-media.net. Attackers register look-alikes by the thousand. - Suspicious TLDs: a well-funded commercial project using a free
.tkor.xyzdomain for its primary download deserves scrutiny. - Extra words glued on:
download-free-vlc-official.comis almost never the real thing. - Freshly registered domains: paste the domain into a WHOIS lookup. A "10-year-old trusted tool" hosted on a domain registered three weeks ago is a scam.
Check the TLS certificate
Click the padlock in your browser and view the certificate. HTTPS alone means nothing — phishing sites use free certificates too. What you want to confirm is that the certificate was issued to the organization you expect and that the domain matches. This is the same discipline I recommend when vetting WordPress plugins before installing: the surface polish is easy to fake, so you verify the underlying identity.
Verification methods compared
No single check is bulletproof. Here's how the main methods stack up so you can layer them intelligently.
| Method | What it proves | Effort | Catches modified files? | Catches fake source? |
|---|---|---|---|---|
| SHA-256 checksum | File is byte-identical to the published version | Low (~30s) | Yes | No |
| Digital signature | Who built and signed the file | Low (~30s) | Yes | Partial |
| URL & WHOIS check | The source is the genuine vendor | Medium (~1min) | No | Yes |
| VirusTotal scan | Known-malware detection across 70+ engines | Low (~1min) | Yes (known threats) | No |
| Sandbox / VM run | Actual runtime behavior | High (~10min) | Yes | No |
The practical takeaway: checksum plus signature
Cover image: Data Security Breach by Visual Content, licensed under BY 2.0 via Openverse.
