Fake Software Installers Disable Windows Update and Weaken Microsoft Defender
Summary: Microsoft reported an active campaign in which fake software-download sites impersonate trusted vendors and deliver installers that disable Windows Update services (wuauserv, UsoSvc, uhssvc, WaaSMedicSvc), add Defender exclusions via PowerShell, delete volume shadow copies, and establish command-and-control on non-standard ports including 5090, 7031, and 28290. Microsoft assessed with moderate confidence the activity is consistent with the Chinese cluster Silver Fox, with victims across healthcare, manufacturing, gaming, technology, logistics, government, and education, primarily affecting China-based operations of multinational organizations and Chinese-speaking users.
What's compelling: The malware's first moves are to blind Defender and stop Windows Update, so the patch and endpoint controls a security team counts on are turned off before the payload is even used. Microsoft contained this one through automated attack disruption, but the campaign's server-side payload generation means the file hash changes on every download, leaving signature-based detection little to match.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026