Fake Software Installers Disable Windows Update and Weaken Microsoft Defender

A malware campaign is currently active, using fake software download websites to distribute malicious installers that impersonate trusted vendors. These installers target users looking to download popular software and have compromised multiple organizations and industries. The campaign primarily affects China-based operations of multinational organizations and Chinese-speaking users. The malicious installers have the capability to disable Windows Update and weaken Microsoft Defender. This allows the malware to maintain its presence on compromised systems. The campaign's impact is notable, with compromises reported across various organizations.