Fake Software Download Sites Push Malware That Turns Off Windows Update
Microsoft says a long-running campaign is pushing rigged installers to Chinese-speaking users and staff at multinationals operating in China, disabling defences on the way in.
Key points
- Microsoft's threat intelligence team is tracking an active campaign that uses fake software download sites to trick people into installing malware.
- The campaign mainly hits Chinese-speaking users and China-based offices of multinational companies, across several industries.
- Rigged installers disable Windows Update and weaken Microsoft Defender, the built-in antivirus, so the infection can stay hidden.
- Victims believe they're downloading well-known software from a trusted vendor's site.
- Microsoft has not publicly tied the activity to a named group, and the reporting so far rests on a single vendor's telemetry.
Microsoft is warning about a malware operation that hides behind fake versions of popular software download pages. People searching for a familiar app land on a lookalike site and install malware instead of what they came for.
The campaign was flagged in Microsoft's own threat intelligence write-up and picked up by The Hacker News. It's aimed mostly at Chinese-speaking users and at staff working in the China-based operations of large multinational firms, with confirmed compromises across multiple industries.
How does the attack actually work?
Someone searches for a common piece of software and clicks a result that looks like the real vendor's page. It's a copy. The installer they download is booby-trapped: it may deliver the app they wanted, but it also drops malware in the background.
From there, the malware goes after the machine's defences. Windows Update gets disabled, cutting off the security patches that would normally close known vulnerabilities. Microsoft Defender then gets tampered with, its ability to spot or remove threats significantly reduced.
With patches blocked and the antivirus hobbled, the intruders have room to work. That could mean credential theft, planting additional tools, or staying quietly on the machine for months.
Our 31 August story on ValleyRAT hiding inside a signed Chinese wallpaper app shows the same playbook: a lure Chinese-speaking users would trust, legitimate-looking packaging, and a goal of disabling the defences that would otherwise catch it.
Who is behind it?
Microsoft hasn't attributed the activity to a named cluster, and no other vendor has publicly corroborated it yet. Confidence in any attribution sits at low.
The targeting profile is consistent with several known China-nexus espionage clusters, including Mustang Panda (tracked by CrowdStrike) and Silk Typhoon in Microsoft's weather-themed naming scheme. It's equally consistent with financially motivated crews seeding poisoned installers to harvest credentials. Capability isn't the same as intent. Without shared infrastructure or specific malware families being called out, treating this as an unattributed campaign with overlapping TTPs to several groups is the safer read.
Fake installer lures aren't new. Groups tracked as FIN7 and Nitrogen have both used them, which makes the technique noisy and hard to pin on any single operator from behaviour alone.
Should you worry?
Stick to the vendor's real website. If you searched for a program and clicked a sponsored or top result, check the address bar carefully before downloading anything. Small spelling changes are the whole trick.
If Windows Update suddenly stops working, or Defender turns itself off and won't come back on, treat it as a red flag rather than a glitch. Both are classic signs something on the machine is fighting the defences.
| Detail | What Microsoft has said |
|---|---|
| Delivery | Fake software download websites impersonating trusted vendors |
| Main targets | Chinese-speaking users; China-based operations of multinationals |
| Impact on defences | Disables Windows Update, weakens Microsoft Defender |
| Named group | None publicly attributed |
| Confidence | Single-vendor reporting, medium confidence in scope |
For company IT teams, the useful signal isn't the lure itself but the tampering. Alerts on Defender being disabled, tamper protection being switched off, or Windows Update services being stopped will catch this class of intrusion regardless of which installer delivered it. Given how fast exploit windows are closing, as we reported on 26 August, anything that deliberately blocks patching deserves immediate escalation.
