InfoSecBulletin Cybersecurity for mankind
Microsoft disables the ms-appinstaller protocol handler by default due to its misuse by several threat actors to spread malware.
“The observed threat actor activity abuses the current implementation of the ms-appinstaller protocol handler as an access vector for malware that may lead to ransomware distribution,” the Microsoft Threat Intelligence team said.
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
ALSO READ:
Cybercriminals offer a malware kit that uses the MSIX file format and ms-appinstaller protocol handler. The changes are in effect in App Installer version 1.21.3421.0 or higher.
The attacks involve signed malicious MSIX application packages. These packages are distributed through Microsoft Teams or malicious ads for popular software on search engines like Google.
Since mid-November 2023, four different hacking groups have been exploiting the App Installer service for financial gain. In October 2023, Elastic Security Labs discovered a campaign involving fake MSIX Windows app package files for popular software like Google Chrome, Microsoft Edge, Brave, Grammarly, and Cisco Webex. These files were used to distribute a malware loader called GHOSTPULSE.
Microsoft disabled the MSIX ms-appinstaller protocol handler in Windows before, in February 2022, to block threat actors from using it to distribute harmful software like Emotet, TrickBot, and Bazaloader.
“Threat actors have likely chosen the ms-appinstaller protocol handler vector because it can bypass mechanisms designed to help keep users safe from malware, such as Microsoft Defender SmartScreen and built-in browser warnings for downloads of executable file formats,” Microsoft said.
