Security researchers have discovered a web social engineering toolkit that enables cyber criminals to create fake update notification campaigns