Open Nav
Sign Up

Microsoft Counters Malware Spread by Disabling MSIX App Installer Protocol

Microsoft Counters Malware Spread by Disabling MSIX App

Bar Refael

January 9, 2024

Microsoft has taken decisive action against a rising tide of malware attacks by disabling the MSIX app installer protocol handler in its Windows operating system. This move comes in response to the protocol’s exploitation by several cybercriminal groups to disseminate ransomware and other malicious software.

Background and Attack Vector:

  • MSIX App Installer Protocol: A Windows component designed to streamline the installation of applications.
  • Method of Abuse: Malicious actors have been using the ms-appinstaller protocol to distribute signed malicious MSIX application packages, often through Microsoft Teams or deceptive online advertisements.

Key Threat Groups and Tactics:

  • Storm-0569 and Storm-1113: Identified as initial access brokers, these groups have exploited SEO poisoning and deceptive installers to distribute malware like BATLOADER, EugenLoader, and others, leading to ransomware deployment.
  • Sangria Tempest (Carbon Spider / FIN7): Utilizes EugenLoader to drop further malware, including Carbanak and Gracewire.
  • Storm-1674: Distributes malicious MSIX installers through deceptive landing pages, masquerading as legitimate services like Microsoft OneDrive and SharePoint.
  • GHOSTPULSE Campaign: Reported by Elastic Security Labs, involved the distribution of malware loaders through counterfeit MSIX Windows app package files.

Microsoft’s Response:

  • Disabling the Protocol: In version 1.21.3421.0 or higher of the App Installer, Microsoft has disabled the ms-appinstaller protocol handler.
  • Historical Context: This isn’t the first instance of Microsoft disabling this protocol, with a similar action taken in February 2022 to prevent the spread of Emotet, TrickBot, and Bazaloader.

Implications:

  • Evasion of Security Measures: The ms-appinstaller protocol was targeted due to its ability to bypass traditional security mechanisms like Microsoft Defender SmartScreen.
  • Impact on security Landscape: Microsoft’s proactive response highlights the evolving nature of cyber threats and the need for continuous vigilance in digital security practices.

Recommendations:

  • System Updates: Users should ensure their systems are updated to the latest version of the App Installer.
  • Vigilance Against Phishing: Caution against phishing attempts through email and other communication platforms.
  • Regular Security Audits: Conduct thorough audits of systems to identify and mitigate potential vulnerabilities.

Microsoft’s disabling of the MSIX app installer protocol marks a crucial step in combating sophisticated malware campaigns. This action underscores the need for ongoing adaptability in cybersecurity defenses against evolving threats. Users and organizations alike must remain vigilant and proactive in their security measures to safeguard against such attacks.

Resources highlights

CVE-2025-55177: WhatsApp Authorization Flaw Exploited in Zero-Click Spyware Chain

WhatsApp has patched CVE-2025-55177, an authorization flaw in its linked-device synchronization feature that was exploited in the wild.  While Meta originally rated it medium severity,…

Read more >

CVE-2025-55177

Docker Issues Patch for Critical Exploit in Docker Desktop: CVE-2025-9074

On August 20, 2025, Docker released an urgent patch for CVE-2025-9074, a critical Server-Side Request Forgery (SSRF) vulnerability (CVSS 9.3) affecting Docker Desktop for Windows…

Read more >

CVE-2025-9074

CVE-2025-48384: Git Submodule Path Flaw Exploited in the Wild

CVE-2025-48384 is a client-side Git vulnerability that lets a malicious repository abuse a mismatch in how Git reads vs. writes configuration values containing a trailing…

Read more >

CVE-2025-48384

CVE-2025-43300: Apple ImageIO Zero-Day Exploited in Targeted Attacks

Apple patched CVE-2025-43300, a zero-day in the ImageIO framework used system-wide to read/write many image formats. Opening or previewing a malicious image can corrupt memory…

Read more >

CVE-2025-43300

CVE-2025-57790: Commvault Path Traversal Vulnerability Leads to RCE

On August 19th, Commvault published advisory CV_2025_08_2 for a newly-discovered path traversal flaw in the Web Server component that allows remote attackers to perform unauthorized…

Read more >

CVE-2025-57790

CVE-2025-20265: Cisco Secure Firewall Management Center (FMC) RADIUS Pre-Auth RCE

A critical (CVSS 10.0)  input-handling flaw in the RADIUS authentication subsystem of Cisco Secure Firewall Management Center (FMC), tracked as CVE-2025-20265 allows unauthenticated remote code…

Read more >

CVE-2025-20265
Under Cyber Attack?

Fill out the form and we will contact you immediately.