Malware Disables Windows Updates via Fake Installers

A sophisticated malware campaign is leveraging fake software download sites to distribute installers that actively disable critical Windows security features. These malicious packages not only turn off Windows Update but also weaken Microsoft Defender protections, leaving systems vulnerable to further compromise.

According to Microsoft, the attack specifically targets users seeking popular software downloads, redirecting them to impostor websites that mimic legitimate vendors. Once installed, the malware systematically disables core security mechanisms, creating persistent backdoors for additional threats.

Attack Vector and Distribution

• Attackers create fake websites that closely resemble legitimate software vendor pages
• Users searching for popular software are redirected to these malicious download portals
• Installers appear authentic but contain hidden payloads that disable security features
• Campaign shows sophistication in mimicking trusted brand interfaces and download flows

Security Impact and Mitigations

• Windows Update service is disabled, preventing critical security patches from installing
• Microsoft Defender settings are altered to reduce detection capabilities
• Multiple organizations across industries have reported successful compromises
• Chinese-speaking users and multinationals in China are primary targets
• Endpoint detection and response tools should monitor for unusual security service modifications

Sources

• Fake Software Installers Disable Windows Update and Weaken Microsoft Defender