Chinese-language fake software download sites handing out archives from Aliyun OSS Hong Kong buckets (Microsoft Teams, WinRAR, NetEase Cloud Music, Soda Music and others)

Chinese-language look-alike download sites for Microsoft Teams, WinRAR, 2345 Image Viewer, NetEase Cloud Music, Soda Music, Driver Genius, a PDF editor, WPS Office, Youdao Translate, Google Chrome, Jianying and Flash, active since at least September 2026 on .top and .com.cn domains such as msteamsoss[.]top, winrarsdwee[.]top, kantuewqang2345[.]top, pdfshwodas[.]top, qudongdasidas[.]top and pc-quicka[.]com[.]cn. Every page is generated separately; the download button points to a ZIP archive in an Aliyun OSS Hong Kong bucket, one bucket per product, and the archives are rebuilt every few hours. A blank variant such as qishuidownload[.]com starts the archive download the moment the page loads. The Microsoft Teams archive holds an installer that drops the genuine Teams setup as a decoy next to a signed third-party program that side-loads an unsigned DLL, which loads an encrypted payload; large unrelated libraries pad the installer to over 60 MB. A match means a page carrying the operator's download-page template, or a scan of a known campaign server, analytics host or download bucket.