Fake Software Installers Disable Windows Update and Weaken Microsoft Defender

An active malware campaign is using bogus software-download websites to impersonate trusted vendors and distribute malicious installers. The campaign has targeted users looking to download popular software and has resulted in compromises across multiple organizations and industries, primarily affecting China-based operations of multinational organizations and Chinese-speaking users, according to Microsoft. The malicious installers modify system settings to disable Windows Update and real-time protection in Microsoft Defender. By disabling these security controls, the threat actors can ensure persistent access to compromised systems, facilitate data exfiltration, and enable further lateral movement within networks. Microsoft has not released a specific patch for this campaign. Users should ensure Windows Update is enabled, avoid downloading software from unofficial sources, and rely on Microsoft Defender with real-time protection enabled. The campaign scope and exact distribution mechanisms are based on observed activity, and attribution to a particular threat actor group remains unverified.