Researchers say the campaign has been active since at least early October and is still very much ongoing, with multiple look-alike domains hosting the fake update screen.