We’ve all experienced that moment: we’re looking for a specific software, we click on the first result, and we end up with a pesky toolbar or worse, a program that has nothing to do with what we wanted. Downloading software safely today requires a minimum of method, as the traps have become so sophisticated that they can fool even experienced users.
Fake installers and bundled software: the concrete threats of 2026
Infection campaigns no longer resemble the crude pop-ups of ten years ago. Analyses published by Sophos X-Ops in August 2026 reveal campaigns targeting users looking to download popular AI tools (ChatGPT, Claude, Copilot), while these services operate directly in the browser without local installation.
The mechanism is formidable: a fake site mimics a known service and offers an installer that deploys a remote control agent. According to Malwarebytes, some campaigns detected in August 2026 install a monitoring tool (like O&O Syspectr) preconfigured to be linked to the attacker’s account. You think you’ve downloaded useful software, but you’ve actually opened a permanent access point to your machine.
Another variant in circulation: scams involving fake technical support where the attacker asks you to install AnyDesk or TeamViewer to “secure” the PC, then takes control remotely. All these scenarios rely on the same reflex: the quick search for software to download without verifying the source.
Check the source before downloading software
The most effective rule remains the simplest: always go through the official site of the publisher. For software like VLC, you go to videolan.org. For LibreOffice, you go through libreoffice.org. The domain name in the address bar is the first security filter, and it costs nothing.
When you don’t know the publisher or are looking for an alternative to paid software, specialized download platforms take over. To understand what FileCR offers, we’re talking about an organized catalog where files are verified before being made available, which reduces the risk of encountering a modified installer.
Some reflexes to systematize before every download:
- Check that the URL matches the official domain of the publisher (be careful of variants with hyphens or intentional misspellings in the name)
- Check the size of the downloaded file: an abnormally light installer (a few hundred KB for a complete software) often hides an intermediate downloader that installs something else
- Run an antivirus scan on the file before executing it, even if the source seems reliable
Package managers on Windows: winget and Chocolatey
On specialized forums, many users are still manually searching for each update of their software. Package managers solve this problem at its root.
Winget is natively integrated into Windows 10 and 11. You open a terminal, type winget install programname, and the installation is done from a repository verified by Microsoft. No checkbox to uncheck, no additional software slipped into the process. The bulk update works with winget upgrade --all.
Chocolatey operates on the same principle with a broader catalog, maintained by the community. Feedback varies on the freshness of some less popular packages, but for common software (Firefox, 7-Zip, Notepad++), both tools do the job cleanly.
The concrete advantage of this approach:
- You never visit a third-party site to download software, which eliminates the risk of a fake site
- Security updates apply with one command instead of checking each software one by one
- You can script the complete installation of a new workstation by listing all the software in a text file
Cyber Resilience Act: what changes for software in Europe
The EU Regulation 2024/2847, known as the Cyber Resilience Act (CRA), will concretely change the game for software publishers selling or distributing in Europe. Publishers will be required to provide security updates for the entire expected lifespan of the product and document the software components used via a SBOM (Software Bill of Materials).
For us, users, this means that software downloaded from compliant European sources will offer more transparent vulnerability tracking. The first incident reporting obligations will gradually come into effect, and products will need to display a verifiable compliance level.
In practice, this regulatory framework pushes download platforms to strengthen their verification processes. Software whose publisher no longer releases security patches will be more easily identifiable as at risk.
Best practices after installing software
Secure downloading doesn’t stop when you launch the installer. Deleting the installation file once the software is in place prevents accidentally relaunching an old executable that no longer benefits from the latest patches.
On Windows, proper uninstallation goes through system settings (“Apps and features”) rather than manually deleting the folder. Poorly uninstalled software leaves entries in the registry and orphaned files that can create conflicts with a future installation.
For portable software (those that run without installation from a USB stick or a dedicated folder), maintenance is different: you simply replace the folder with the updated version. This approach works well for tools that are used occasionally on multiple machines.
The reflex that best protects remains to keep your operating system and software up to date. The majority of attacks exploit known vulnerabilities for which a patch already exists. Up-to-date software downloaded from a verified source covers the vast majority of risks we face daily.