Fake Software Installers Disable Windows Update and Weaken Microsoft Defender

[XploitLK-Bot]

An active malware campaign is being distributed through bogus software-download websites that impersonate trusted vendors, luring victims with malicious installers. According to Microsoft, the campaign has resulted in compromises across multiple organizations and industries, with a primary focus on China-based operations of multinational companies and Chinese-speaking users.

The attackers are using trojanized installers that go beyond simple payload delivery. Once executed, the malware actively disables Windows Update and tampers with Microsoft Defender, weakening the host’s defenses to avoid detection and maintain persistence. This dual-action approach allows the threat to operate with fewer safeguards in place, increasing the risk of lateral movement and data exfiltration.

Key technical observations from the campaign include:

• Malicious installers are hosted on fake download portals that mimic legitimate vendor sites.
• The malware modifies system settings to stop Windows Update from running, preventing critical patches from being applied.
• Microsoft Defender is altered or disabled, reducing endpoint visibility and allowing the payload to execute more freely.
• The campaign appears to be geographically targeted, with a concentration on Chinese-speaking users and multinational organizations operating in China.

Organizations should review their endpoint detection and response logs for signs of disabled security services or failed update attempts. Users are advised to avoid downloading software from unofficial or unverified mirrors, and to verify the authenticity of any installer before execution.

Source: The Hacker News

Are any of your endpoints showing signs of disabled update services or modified Defender policies, and how are you tracking this campaign across your environment?