Microsoft’s Response to Malware Distribution via App Installer

Since November 2023, Microsoft has been dedicated to closely monitoring and addressing the misuse of the ms-appinstaller URI scheme, also known as App Installer, by threat actors for the distribution of malware. This decision follows the discovery of financially motivated groups such as Storm-0569, Storm-1113, Sangria Tempest, and Storm-1674 exploiting this tool for malicious purposes.

In a blog post from Microsoft Threat Intelligence, the company outlined its actions, stating, “In addition to ensuring that customers are protected from observed attacker activity, Microsoft investigated the use of App Installer in these attacks. In response to this activity, Microsoft has disabled the ms-appinstaller protocol handler by default.” It is evident that Microsoft has taken a proactive stance to safeguard its users from potential harm.

The exploitation of the ms-appinstaller protocol handler was identified as a significant concern, serving as an access vector for malware and leading to the distribution of ransomware. Microsoft also highlighted that cybercriminals have been offering a malware kit as a service, exploiting the MSIX file format and ms-appinstaller protocol handler for their illicit activities.

Furthermore, malicious actors have been distributing signed malicious MSIX application packages through deceptive means, including websites accessed via nefarious advertisements for legitimate popular software. Additionally, groups like Storm-1674 have utilized phishing attempts through Microsoft Teams to advance their malicious agenda.

According to Microsoft, the use of the ms-appinstaller protocol handler as a malware distribution vector is particularly worrisome due to its ability to bypass safety mechanisms such as Microsoft Defender SmartScreen and built-in browser warnings for executable file formats. This facilitates threat actors in reaching their targets and carrying out their malicious activities undetected.

In light of these findings, it is evident that Microsoft has taken significant measures to protect its users from the potential dangers posed by the misuse of the ms-appinstaller protocol handler. Through the default disabling of this feature, Microsoft has demonstrated its commitment to preventing the distribution of malware through this avenue.

In conclusion, Microsoft’s swift and decisive action against the exploitation of App Installer for malware distribution underscores the company’s dedication to user safety and security. Users must remain vigilant and ensure that they have the necessary security measures in place to protect themselves from potential cyber threats.