Microsoft blocks the “ms-appinstaller,” which hackers exploit to distribute malware.

The IT giant claims that the observed threat actor behavior exploits the way the ms-appinstaller protocol handler is currently implemented as an entry point for malware that might spread ransomware.

Microsoft noticed that threat actors were utilizing the ms-appinstaller URI scheme (App Installer) to spread malware, thus it stopped it.

According to Microsoft, since mid-November 2023, threat actors—including those with financial motivations—such as Storm-0569, Storm-1113, Sangria Tempest, and Storm-1674—have been seen using the ms-appinstaller URI scheme (App Installer) to spread malware.

Microsoft looked at the use of App Installer in these attacks in addition to making sure that customers are safe from observed attacker activity. Microsoft said that as a result of this behavior, the ms-appinstaller protocol handler has been turned off by default.

The IT giant claims that the observed threat actor behavior exploits the way the ms-appinstaller protocol handler is currently implemented as an entry point for malware that might spread ransomware.

Additionally, it was noted that several fraudsters are offering a malware kit for sale that exploits the MSIX file format and the ms-appinstaller protocol handler exploitation.

Related Article: ब्राउज़र को हाईजैक करते हुए 1.5 मिलियन मालिसियस क्रोम वीपीएन एक्सटेंशन इंस्टॉल किए गए हैं (Malicious Chrome VPN Extensions)

“These threat actors use websites that are accessible through malicious adverts for popular software that is actually legitimate to distribute signed malicious MSIX application bundles. Storm-1674 also uses Microsoft Teams as a second phishing vector, according to the business.

Because “it can bypass mechanisms designed to help keep users safe from malware, such as Microsoft Defender SmartScreen and built-in browser warnings for downloads of executable file formats,” Microsoft claims that hackers have most likely selected the ms-appinstaller protocol handler vector.

Microsoft Threat Intelligence found numerous cybergangs using App Installer as a conduit for ransomware operations in mid-November of this year.

As the study states, the observed activity involves installing malicious MSIX packages under the guise of legal apps, impersonating legitimate applications, and avoiding detections on the initial installation files.

How can I protect my computer from hackers?(FAQs)

Your computer can be secured against hackers in a number of ways:

1. Use strong passwords: Make complicated passwords that are hard to guess by combining digits, capital and lowercase letters, and unique characters. Avoid using the same password on several accounts or websites. In the unlikely event that a hacker manages to decipher one of your passwords, this lessens the harm to you.
2. Use a password manager: You may establish a complex and distinct password for every website without having to worry about inputting the password itself more than once thanks to password managers, which save and automatically populate your login information for other websites. The third-party password managers “Dashlane 4,” “LastPass 4.0 Premium,” “1Password,” “Sticky Password Premium,” and “LogMeOnce Ultimate” are among the highly regarded ones. Your passwords are stored in most browsers’ built-in password managers, albeit they usually aren’t encrypted.
3. Keep your software up-to-date: Ensure that the most recent security updates are installed on your operating system, web browser, and other applications. This can lessen the likelihood that hackers will take advantage of known weaknesses.
4. Use antivirus software:Set up and maintain your computer’s antivirus program. This can assist in identifying and eliminating malware that might be utilized by hackers to access your computer.
5. Be cautious of suspicious emails and links: Avoid opening attachments or clicking links in shady emails. These might be attempts at phishing, which are meant to deceive you into disclosing personal information.
6. Use a firewall: Unauthorized internet access to your computer can be prevented with the aid of a firewall. You can activate the firewall that is built into the majority of operating systems.
7. Use a VPN: Your internet traffic can be encrypted and your IP address can be hidden with a virtual private network (VPN), which helps safeguard your online privacy and security.

By following these tips, you can help protect your computer from hackers and other security threats.

How do I know if my computer has been hacked?(FAQs)

There are various indications that someone may have hacked into your computer. These are a few of the most typical ones:

1. Your computer is running slowly: It may indicate that your computer has malware on it if it is operating slower than usual.
2. Your computer crashes frequently: Your computer may have been compromised if it keeps crashing or if error messages are appearing on it.
3. You notice new programs or files on your computer: It may indicate that your computer has been hacked if you discover new apps or files that you did not download or install.
4. Your web browser behaves strangely: Your computer may have been compromised if your web browser is acting suspiciously, such as displaying pop-up advertisements or rerouting you to unknown websites.
5. Your antivirus software is disabled: Your computer may have been compromised if your antivirus program has been disabled or is malfunctioning.

You should act quickly to safeguard your data and stop additional harm if you think your computer has been hacked. Changing your passwords, updating your software, and doing a malware scan are among actions you may take.

Please Follow Me on Social Media

Following me on social media is as easy as a few clicks. Simply search for my handle or name on your preferred social media platform and hit that “Follow” or “Subscribe” button. Here are the platforms you can find me on:

• Twitter: @ShahSumsh
• Instagram: @shah.alam.shumsh
• Facebook: ShahTech
• LinkedIn: YourProfile
• YouTube: ShahTech