workerstats.net: a server reported for fake Microsoft Activation Scripts files, and what to do if a command fetched them

Q: What does the tag fakemas mean?

We could not find a page that defines it. Our reading is that it stands for a fake copy of Microsoft Activation Scripts, MAS, a free tool that activates Windows and Office. The real project warns that third parties spread malware disguised as MAS by changing the address in the PowerShell command. So the tag fits a known pattern, but it is a label from a reporter, not a proof of what the files do.

Q: I saw workerstats.net in my firewall or DNS log. Am I infected?

Not necessarily, and the name alone proves nothing. It does mean that a device on your network asked for it, and a person does not usually do that by hand. Find which device it was, disconnect it, and run the checks on this page: Task Scheduler; Startup apps; Task Manager; Protection history; a Microsoft Defender Offline scan. Do the account changes from another device. A scanner or a research tool can also trigger such a log entry.

Q: How do I remove what it installed from Windows?

Change your passwords from another device first. Then run a Microsoft Defender Offline scan (Windows Security, Virus and threat protection, Scan options), check Task Scheduler and Startup apps for entries you did not make, and delete the ones you can tie to the command you ran. If you are not sure, reset Windows with Remove everything and restore only documents. We followed Microsoft's pages for this and did not test the steps on an infected PC.

Q: Does workerstats.net affect Mac, iPhone or Android?

We found nothing that says so. Microsoft Activation Scripts is for Windows and Office, and the command people paste is a PowerShell command. On a Mac, iPhone or Android phone there is nothing to remove for this threat; if you typed a password on a suspicious page, change it. Do not follow the Windows steps on those devices.

workerstats.net is a web address that URLhaus lists four times in September 2026 for files tagged fakemas (two text files also tagged python, two ZIP archives), all now offline. The tag suggests a copy of the Windows activation tool Microsoft Activation Scripts, but nobody has published a write-up of this address, so what the files do is not confirmed.

If you only saw the name in a log, nothing is proven; if you ran an activation command from a page you did not fully trust, treat the PC as possibly infected: change passwords from another device, then scan and clean or reset Windows.

By Ugnius KiguolisPublished October 17, 202610 min read

Facts checked October 17, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation.

Automatic

Get a free scan and check if your PC is infected.

Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.

If a command, script or program that downloads files from workerstats.net keeps coming back after uninstalling, a scan can find what reinstalls it.

Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free.

Do it yourself · free Remove workerstats.net (fakemas, python and ZIP files) yourself 5 steps, about 15 minutes, no software needed.

Start the steps

Four boxes showing a possible route: a bait that looks like Microsoft Activation Scripts, a request to workerstats.net, Python code in text files, and ZIP archives — Our reading of how the four reported files may fit together. Our own request to the address failed because the name did not resolve, so this is a diagram of the reports, not a screenshot of the site.

Workerstats.net (fakemas, python and ZIP files): summary

Type	A malware server: URLhaus lists four files tagged malware_download and fakemas, two of them also python, two ZIP archives
Risk	High if a command or script on your PC fetched its files: the payload is unknown. Low if you only saw the name
Symptoms	Often none. Unknown scheduled tasks or startup entries, an unexplained python.exe or powershell.exe, or a slow hot PC are the leads
How to get rid of it	Change passwords from another device, run Microsoft Defender Offline, remove the startup entries, and reset Windows if you are not sure
Our check (17 October 2026)	One plain request from our server: the name did not resolve, no page. That clears nothing; the danger rating comes from URLhaus
Running since / first seen	Domain registered 28 January 2026; first files reported 17 September 2026
Removal	Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free.

Show 9 more facts

Platform	Windows is the likely target. Nothing we read says Mac or phones are affected
Detection names	No Microsoft detection name is known for the files on this server, because we did not open them
Name	Workerstats.net
Domain registered	28 January 2026
Evidence	4 write-ups by security sites; details still limited
First seen	17 September 2026
Distribution	Typically fake installers, cracked programs, e-mail attachments, fake "verify you are human" pages and ads for popular apps
Damage	Installs other malware, often several programs at once
Facts checked	17 October 2026

Facts checked on 17 October 2026 against the URLhaus data for workerstats.net held in our database (we did not fetch the abuse.ch page itself), RDAP, one plain request of our own from our server, the MAS project README, ThaiCERT, Gridinsoft and Microsoft pages. We did not download the files and we infected no PC; the removal steps follow Microsoft's pages and were not tried on a live infection.

What workerstats.net is, and what we know about it

workerstats.net is not a program on your PC. It is a web address that the abuse.ch project URLhaus lists as a place where malware was served. We found no public write-up of this one address, so what follows is what URLhaus shows, what we saw ourselves, and what the sources we read say about the kind of campaign the tags point to.

1
What URLhaus lists
Four file addresses on workerstats.net. Two ZIP archives, getthem20084.zip and nig20084.zip, were added on 17 September 2026 within four seconds of each other. Two text files, global.txt and downloadables/SysMon.txt, were added on 21 September 2026 about 19 seconds apart. All four carry the threat label malware_download, all four are marked offline, and the reporter is the same user for every row.
2
What the tags mean
The tag fakemas is on all four rows. Our reading is that it stands for a fake copy of Microsoft Activation Scripts, often called MAS, a well known free tool that activates Windows. We could not find a page that defines the tag, so this is an interpretation, not a quote. The tag python is only on the two text files. It suggests that the text files hold Python code, but we did not open them. The tag zip simply says the other two are archives.
3
What we could not confirm
We downloaded none of the files, so we cannot tell you what is inside them, what they install, or where they send data. We also do not know how a victim's PC is led to ask for them. That first step is not visible from the server side, and the files are offline, so nobody can look at them now.
4
What this means for you
If you saw the name in a firewall log, a blocked request or a warning, you are not infected by that alone. The risk is for a PC where something already ran a command or script that fetched one of these files before they went offline. A normal visitor has no reason to ask for files like these.

Kind of threat: A server reported for malware download files tagged fakemas: two text files tagged python and two ZIP archives
Where the files were: hxxps://workerstats[.]net/global.txt, hxxps://workerstats[.]net/downloadables/SysMon.txt, hxxps://workerstats[.]net/downloadables/nig20084.zip and hxxps://workerstats[.]net/downloadables/getthem20084.zip
Domain registered: 28 January 2026, registrar NICENIC INTERNATIONAL GROUP CO., LIMITED; status client delete prohibited and client transfer prohibited (RDAP, read 17 October 2026)
URLhaus entries: 4 file addresses, added 17 and 21 September 2026; all 4 offline when we read our copy of the data
Delivery trick: Unknown. The tag fakemas points to an imitation of Microsoft Activation Scripts, a tool people run to activate Windows, but this is our reading
Platform: Windows is the likely target, because the imitated tool is for Windows. Nothing we read says Mac, iPhone or Android are affected

What workerstats.net (fakemas, python and ZIP files) does on an infected PC

What we checked on 17 October 2026, and what we could not

Our check was a plain request from our server to the address on 17 October 2026. It failed before any page could answer: the name workerstats.net did not resolve (error ENOTFOUND). That clears nothing, and it does not mean the operator has stopped.

Our check, 17 October 2026

The name did not resolveOur server asked for the address of workerstats.net and got no answer (getaddrinfo ENOTFOUND). The usual reasons are that the DNS records were removed, for example after an abuse report, that the operator took them down, or that the name is parked without records. We do not know which one it is.
Why that is not a clean resultThis was a single request from a single location on a single day. Malware servers move, change names and come back. A name that does not resolve today says nothing about the files that were served in September.
Notification request, pop-ups, redirects, ad networksNone seen. There was nothing to see: no page loaded. We made no browser visit with a screenshot.
URLhaus listingFour files tagged malware_download and fakemas, two of them also python. All four marked offline in our copy of the data.
Downloads and the files themselvesWe did not download any file, so we cannot tell you what the files contain.

Dangerous: treat it as a malware server Our check was one request that ended in a lookup error, so it proves nothing either way. The danger rating comes from the four URLhaus reports and their tags, not from our request. Do not request files from this address and do not run anything that does.

What happened to workerstats.net, from registration to our check

The domain is under nine months old and the reports are all from five days in September. The dates come from RDAP and from the URLhaus data we hold; the times are UTC.

28 January 2026
The domain is registered
RDAP shows workerstats.net registered on 28 January 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. The record carries the statuses client delete prohibited and client transfer prohibited, which are locks set at the registrar and say nothing about the use of the name.
17 September 2026
Two ZIP archives are reported
At about 05:45 UTC URLhaus receives getthem20084.zip and nig20084.zip, both from the downloadables folder, both tagged fakemas and zip, both marked malware_download. The number 20084 appears in both names; we do not know what it means.
21 September 2026
Two text files tagged python
At about 14:33 UTC the same reporter adds global.txt and downloadables/SysMon.txt, tagged fakemas and python. A file called SysMon suggests a system monitor, but that is only the name; we did not open it.
17 October 2026
All four are offline, and the name does not resolve
In our copy of the data every row is marked offline. Our own request on the same day cannot even find the server. The picture below puts the dates on one line.
The known dates for workerstats.net. Everything between the registration and the first report is unknown to us.

What the pattern suggests, and what it does not: four files in two batches over five days, then silence, looks like an operator testing a delivery chain rather than one leftover file. That is our reading of the dates, not something any report says. A gap of nearly four weeks between the last report and our check does not tell us whether the operator moved to another name.

What Microsoft Activation Scripts is, and why a fake copy is a good trap

Microsoft Activation Scripts, MAS, is a free open source project that activates Windows and Office. Because it is used by many people and is normally run as a single line pasted into PowerShell, an imitation is easy to hide among the real thing.

1
How the real tool is run
The project's own README gives one command, irm https://get.activated.win | iex, and names massgrave.dev as the home page and github.com/massgravel/Microsoft-Activation-Scripts as the source. The command downloads a script from the address and runs it at once. That is convenient for the honest project and just as convenient for a copy.
2
What the project warns about
The README tells people to be careful of third parties who spread malware disguised as MAS by changing the address in the PowerShell command, and to double check the address before running it. We read this warning on 17 October 2026. It does not name workerstats.net, and we do not claim that this server is connected to the project.
3
A documented case of a look alike address
ThaiCERT describes a campaign in which attackers registered an address that is one letter away from the real one and so caught people who mistyped the command. According to the report the result was a loader called Cosmali that delivered cryptominers and the XWorm remote access trojan. This is a different address and a different set of files; we use it only to show that the trick has been seen in the real world.
4
What we cannot say about this server
The tag fakemas is the only link we have between workerstats.net and MAS. We do not know whether the files imitate the tool, were meant to be run by a command like the one above, or came by some other route. The honest summary is: reported as malware, tagged with a name that points at an activation tool, content unknown.

Sources: the MAS README on GitHub, ThaiCERT and Gridinsoft, read 17 October 2026.
Question	What the sources say	Source
What is the real tool?	A free activation project with a home page at massgrave.dev and source code on GitHub	MAS README on GitHub
How is it normally run?	One PowerShell line that downloads a script from get.activated.win and runs it	MAS README on GitHub
Is a fake copy a known thing?	Yes. A look alike address was used to deliver the Cosmali loader	ThaiCERT
Is workerstats.net one of them?	Not confirmed. URLhaus tags its files fakemas; no write-up of the address exists in the sources we read	URLhaus rows in our data
Do other activators carry malware?	Gridinsoft says activators of the AutoKMS kind are flagged by Microsoft as HackTool:Win32/AutoKMS for licence bypass, and advises checking for bundled payloads, not only removing the activator	Gridinsoft

What workerstats.net (fakemas, python and ZIP files) can steal or download

What this can cost you

Reading the name or seeing it in a log costs nothing. The risks below apply to a Windows PC where a command, script or installer fetched and ran one of these files. Because we do not know what the files do, the list is based on what the kind of campaign usually delivers, not on the files themselves.

High
Passwords and accounts
If the payload is a stealer or a remote access trojan, as in the Cosmali case ThaiCERT describes, saved browser passwords and logins are at risk. Changing passwords from the same PC would not help.
High
Someone using your PC
A remote access trojan lets a person act on the PC while you are signed in. ThaiCERT names XWorm in the look alike campaign. Whether this server served anything like it is not known.
Medium
Slow PC and heat from a miner
The same campaign delivered cryptominers. A miner uses the processor and graphics card for someone else's profit and shows as a PC that is slow or loud for no reason.
Medium
Windows activation tools themselves
Gridinsoft says licence bypass tools are flagged by Microsoft, and that bundled payloads are the larger worry. Even a working activator is software from an unknown author running with high rights.
Low
Nothing, if you only saw the name
A name in a block list, a router log or a warning is not an infection. Find which device asked, and check that one.

What you may notice, and what you may not

We do not know the payload, so we cannot list signs that belong to it. The table gives the general signs of the families named in the sources, and says plainly that many victims see nothing.

Sign	What the reports show
A scheduled task or startup entry you did not make	Activation hacktools often add a task to renew the activation; Gridinsoft describes this for AutoKMS tools. Malware also uses tasks to start again after a restart. A task you cannot explain is worth a look
A PowerShell or Python process you did not start	The tags python and fakemas point to scripts. A python.exe or powershell.exe running with no reason is a lead, not proof
A Defender detection with a name like HackTool:Win32/AutoKMS or one containing FakeMas	Gridinsoft names the first for activators. We could not confirm a Microsoft name for the files on this server
A slow, hot or noisy PC	Typical for a cryptominer, which ThaiCERT lists for the look alike campaign
Accounts you did not touch	Logins from new places, password reset emails, messages sent from your accounts. This follows from stolen logins; it is our reading
Nothing at all	Loaders and remote access tools are built to be quiet

How to check the PC for workerstats.net (fakemas, python and ZIP files)

Who can meet this, and how a PC ends up asking for these files

Nobody visits workerstats.net on purpose. The request comes from a program, so the real question is how that program got onto the PC. We cannot say for this server. The routes below are the ones the sources describe for fake activation tools.

1
A pasted PowerShell command
The real MAS is run by pasting one line into PowerShell. A page, video or forum post that offers a changed line, or a line with a mistyped address, can fetch something else. ThaiCERT describes exactly this with a one letter difference.
2
A downloaded archive or installer
Two of the four reported files are ZIP archives. Free activators, cracks and key generators are commonly passed around as archives, and Gridinsoft advises looking for bundled payloads in them. We do not know that these archives were offered that way.
3
A script run by another program
The two text files tagged python may be fetched by a first program that is already running, not by a person. In that case the cause is earlier in the chain and the PC was already affected.
4
Not a person at all
A security tool, a researcher or a network scanner can also request such addresses. A log entry from a business network is not proof that someone installed anything.

Check your PC before you delete anything

Start with the question that matters: did you or a program on this PC run an activation command, an activator, a crack or a script from a page that was not the project's own? If you saw workerstats.net in a router or DNS log, the device that asked is the one to check. If the answer is yes or you are not sure, do the checks below. None of them deletes anything.

While you check, stop using the PC for banking, email, work or crypto, and disconnect it from the network if you can.

1
Disconnect first
Turn off Wi-Fi or unplug the network cable. Many kinds of malware need the connection to send data or receive orders.
2
Find which device asked for the address
If you came here from a log, a router page or an alert, note the device and the time. Only that device is in question, not every device on the network.
3
Check how you activated Windows or Office
Ask yourself whether you ever ran an irm ... | iex line, an activator program or a crack. If you did, find the exact address you used. The real project's address is get.activated.win; anything that differs by a letter is a warning sign. Check the PowerShell history only if you know how; do not run commands you do not understand.
4
Open Task Scheduler
Press Start, type Task Scheduler and open it. Look in Task Scheduler Library for tasks you do not know, with random names, or that run a script or a program from a user folder. Write down the name and the program it runs. Do not delete yet.
5
Look at Startup apps and installed apps
Open Settings > Apps > Startup and switch off nothing yet, only note names you did not install. Then open Settings > Apps > Installed apps and look for programs you do not know, such as an activator, a monitor tool or a Python install you did not make.
6
Look at Task Manager
Open Task Manager and the Processes tab. Sort by CPU and look for python.exe, powershell.exe or an unknown name using a lot of processor or network. A real Windows program can be abused, so a name alone proves nothing, and a quiet list does not clear the PC.
7
Open Protection history
In Windows Security > Virus & threat protection > Protection history, look for anything blocked or quarantined around the time you ran the command. Microsoft says the results of an offline scan also appear there.
8
Check your accounts from another device
Look at the sign in activity of your email, bank and exchange accounts, and at crypto balances. This is quicker than any file check.
9
A scan helps, but it does not clear the PC
A scan with Microsoft Defender or another product can find known files. Treat a clean result the way you treat a quiet site test: one data point. No vendor publishes a removal procedure for this server's files and we did not infect a PC, so the order of the plan is our judgement from Microsoft's pages, not a tested result.

How to remove workerstats.net (fakemas, python and ZIP files)

How to remove workerstats.net

A loader's job is to install other malware, so treat the PC as infected with more than one program until the scans are clean.

Step 1: Delete scheduled tasks that bring it back
Programs like workerstats.net add a scheduled task so they return after an uninstall or reopen a page at every sign-in. Start Task Scheduler, open Task Scheduler Library and sort by Last Run Time to see what ran recently.
On the Actions tab, a program in a user folder, a script or a web address is a warning sign; right-click such a task and choose Delete.
Tasks with names copying Google, Edge or Windows updaters but pointing to an odd folder are typical. The tool looks the same in Windows 11 and Windows 10.
Windows 11: Task Scheduler Library, the task selected, the Actions tab shows the file it runs.
Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 2: Remove it from startup
Press Ctrl + Shift + Esc to open Task Manager and select Startup apps (Windows 11) or the Startup tab (Windows 10). Disable entries you do not recognise, especially ones with no publisher or with a name that copies a Windows component.
Right-click an entry and choose Open file location to see where it runs from: programs in %AppData% or %Temp% deserve a closer look. Some entries are not listed there but in the registry Run keys, which the procedure below shows how to check.
Full procedure with screenshots: Stop apps from opening at startup On uGetFix
Step 3: Delete the folders left behind
Uninstalling often leaves the program's folders, and some threats reinstall themselves from them.
Press Windows + R, type %LocalAppData% and press Enter, then do the same for %AppData% and %ProgramData%, and look for folders named after workerstats.net, its publisher or created on the day the problem started. Delete those folders, and check C:\Program Files and C:\Program Files (x86) too.
If Windows says a file is in use, end it in Task Manager or delete the folder after a restart in Safe Mode. The folders are the same in Windows 11 and Windows 10.
Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 4: Scan the PC, then run the offline scan
A scan finds the parts of workerstats.net that the manual steps cannot see. In Windows Security > Virus & threat protection > Scan options, start a Full scan and quarantine what it reports.
Follow it with Microsoft Defender Antivirus (offline scan) > Scan now, which restarts the PC and checks the disk while Windows and the malware are not running.
It takes about 15 minutes and works the same in Windows 11 and Windows 10. If either scan finds something, run the full scan again after removal until it comes back clean.
Windows 11: Windows Security > Virus & threat protection > Scan options.
Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 5: Change passwords from another device and sign out other sessions
Workerstats.net can copy saved passwords, cookies and session tokens and send them out in seconds, so cleaning the PC does not undo the theft.
Change your passwords on a device that was never infected, starting with the e-mail account, since every other reset goes through it. On each account, end all other sessions and check the recovery e-mail, phone number and forwarding rules.
Then turn on two-step verification. Sign in on the Windows 11 or Windows 10 PC again only after the offline scan is clean.
Full procedure with screenshots: Turn on two-step verification / secure a hacked account

If you use a Mac, an iPhone or an Android phone

The tag points at a Windows activation tool. We found nothing that says the files on workerstats.net affect anything else.

Your device	What we know	What to do
Mac	Microsoft Activation Scripts is for Windows and Office, and the PowerShell command is a Windows command. We found no report of these files on a Mac	Nothing to remove for this threat. Do not follow the Windows steps on a Mac
iPhone or iPad	No source describes it on iOS	Nothing to remove. If you typed passwords on a page, change them
Android	No source mentions it	Nothing to remove for this threat; change passwords if you entered any

After removal: passwords, accounts and prevention

If a command ran: clean the PC and protect what was taken

The PC is one half. The other half is everything you typed or stored on it while the unknown program was there. The order matters: another device first, then the PC.

Five steps in order: disconnect the PC, change passwords from another device, run a Defender Offline scan, check tasks and startup, reset Windows if unsure — The order of actions if a fake activation command ran on a PC. Steps follow Microsoft's pages; we did not test them on an infected PC.

1
Change passwords from a clean device
Use a phone or another PC that never ran the command. Start with email, because it resets everything else, then bank, work, cloud storage and crypto. Anything typed on the affected PC while the program was there may be known.
2
Sign out other sessions and turn on two step sign in
Most big services let you sign out of all devices from the account's security page. Turn on two step sign in with an authenticator app or a security key where it is offered, and update the recovery email and phone.
3
Move crypto first if a wallet was on the PC
If a seed phrase or wallet file was ever on the PC, assume it is known. Create a new wallet and recovery phrase on a clean device and move the funds there.
4
Run Microsoft Defender Offline
Microsoft Learn says to open Windows Security > Virus & threat protection > Scan options, choose Microsoft Defender Offline scan and select Scan now. Save your work first: Windows signs you out and restarts, and the scan takes about 15 minutes. It runs outside the normal Windows, so malware has a harder time hiding. If BitLocker is on, suspend it first or the restart may ask for the recovery key. Results are under Protection history. Microsoft notes that the offline scan does not run if the Windows Recovery Environment is disabled, and gives reagentc /info to check it.
5
Remove what the check found, with care
If Task Scheduler or Startup apps showed an entry that you can tie to the activation command, delete that entry and the program it points to. Uninstall unknown programs under Settings > Apps > Installed apps. If you cannot tell what an entry is, do not guess: the safe answer is the reset below.
6
If you are not sure, reset Windows
The reset is under Settings > System > Recovery > Reset this PC. Keep my files removes apps and settings but keeps personal files; Remove everything wipes the PC. For a PC that may have been under someone's control, the full wipe is the answer that does not depend on finding every piece. Back up documents first.
7
Restore only documents by hand
Copy back documents and photos, not programs, and not a full system image from after the command ran. Install apps from their makers' own sites.
8
Activate Windows the legitimate way
If you used a tool because you had no licence, the clean route is a licence bought from Microsoft or a reseller you trust. Using an unofficial activator again brings the same risk back.
9
Watch your money and your accounts
Check card statements and exchange logs for a few weeks and turn on alerts. If personal data was taken, report it to your national consumer or police service.

Keep a PC out of this kind of chain

The files on this server are late in a chain. Every route the sources describe starts earlier, with a command or a download that a person chose to run.

Read every address in a PowerShell line letter by letter before you press Enter. The real MAS project names get.activated.win in its own README.
Take scripts only from the project's own page or repository, not from videos, comments or forums.
Keep Windows and Microsoft Defender updated; the offline scan uses the latest definitions.
Get programs from their makers' own sites or from the Microsoft Store.
Use a password manager and two step sign in, so one stolen password is not enough.
Keep a backup of documents on a disk that you unplug.

Don't

Do not paste a command into PowerShell that you cannot read and explain.
Do not run cracks, key generators or activators from sites that promise free versions of paid software.
Do not change your passwords on the PC you suspect.
Do not rely on a quiet scan or an offline server to say that you are safe.

Questions about workerstats.net (fakemas, python and ZIP files)

What is workerstats.net?

It is a web address that URLhaus, the malware tracking project run by abuse.ch, lists for four files: two ZIP archives added on 17 September 2026 and two text files added on 21 September 2026.

All four carry the tag fakemas, the text files also python, and all four are marked offline. It is not a program on your PC and not a website anyone is meant to visit. We did not download the files, so what they contain is not confirmed by us.

Is workerstats.net safe to open?

No. Do not request files from it and do not run anything that does. When we checked on 17 October 2026 the name did not resolve from our server, so no page loaded, and that proves nothing:

malware servers move
change names
return

The rating comes from the four URLhaus reports and their tags, not from our request. If you already opened the home page in a browser and did nothing else, there is no sign that this alone harmed you.

What does the tag fakemas mean?

We could not find a page that defines it. Our reading is that it stands for a fake copy of Microsoft Activation Scripts, MAS, a free tool that activates Windows and Office.

The real project warns that third parties spread malware disguised as MAS by changing the address in the PowerShell command. So the tag fits a known pattern, but it is a label from a reporter, not a proof of what the files do.

Is Microsoft Activation Scripts itself a virus?

We have no evidence that the real project is malware, and its README points to an open source repository. But it is an unofficial way to activate Windows, and Microsoft Defender may flag such tools.

The danger we can document is the copies: ThaiCERT describes a look alike address that delivered a loader with cryptominers and the XWorm trojan. If you want certainty, the safe path is a licence bought from Microsoft or a trusted reseller.

I saw workerstats.net in my firewall or DNS log. Am I infected?

Not necessarily, and the name alone proves nothing. It does mean that a device on your network asked for it, and a person does not usually do that by hand. Find which device it was, disconnect it, and run the checks on this page:

Task Scheduler
Startup apps
Task Manager
Protection history
a Microsoft Defender Offline scan

Do the account changes from another device. A scanner or a research tool can also trigger such a log entry.

How do I remove what it installed from Windows?

Change your passwords from another device first. Then run a Microsoft Defender Offline scan (Windows Security, Virus and threat protection, Scan options), check Task Scheduler and Startup apps for entries you did not make, and delete the ones you can tie to the command you ran.

If you are not sure, reset Windows with Remove everything and restore only documents. We followed Microsoft's pages for this and did not test the steps on an infected PC.

What can the files take from my PC?

We do not know, because we did not open them and no write-up exists. The family named in the nearest documented case, a look alike MAS address described by ThaiCERT, delivered cryptominers and the XWorm remote access trojan.

A trojan of that kind can log keys, view the screen and take files. Treat every password, session login and wallet on an affected PC as known until you have changed them from another device.

Does workerstats.net affect Mac, iPhone or Android?

We found nothing that says so. Microsoft Activation Scripts is for Windows and Office, and the command people paste is a PowerShell command.

On a Mac, iPhone or Android phone there is nothing to remove for this threat; if you typed a password on a suspicious page, change it. Do not follow the Windows steps on those devices.

The files are offline. Does that mean I am safe?

Offline means URLhaus could not fetch them when it last checked. It does not undo anything that ran earlier. A PC that fetched and ran a file in September keeps whatever it installed, and the operator may serve the same files from another name.

If you ran an activation command or an activator from an unclear source around that time, do the checks and the Defender Offline scan, and change passwords from another device.

Will Fortect remove workerstats.net?

Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.

For workerstats.net, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.

Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.

Sources

Microsoft-Activation-Scripts README on GitHub (massgravel) (read October 17, 2026)
ThaiCERT: Warning, Fake Domains Impersonating MAS Used to Install Cosmali Loader Malware (read October 17, 2026)
Gridinsoft: HackTool:Win32/AutoKMS Removal, KMS Activator Risks (read October 17, 2026)
Microsoft Learn: Microsoft Defender Offline scan in Windows (updated 25 August 2026) (read October 17, 2026)
Microsoft Support: Protect your PC from ransomware (read October 17, 2026)