Malware Campaign Exploits Fake Installers to Bypass Windows Security Features

A malware campaign uses fake software installers to disable Windows Update and weaken Microsoft Defender, targeting organizations in China and other regions. The attack employs techniques like scheduled tasks, DLL sideloading, and C2 communication over non-standard ports to maintain persistence and evade detection.

An active malware campaign is using bogus software-download websites to impersonate trusted vendors and distribute malicious installers.

"The campaign has targeted users looking to download popular software and has resulted in compromises across multiple organizations and industries, primarily affecting China-based operations of multinational organizations and Chinese-speaking users," Microsoft

Read original article