Fake Software Installers Disable Windows Update and Weaken Microsoft Defender

An active malware campaign has been identified that employs bogus software‑download websites to impersonate trusted vendors and deliver malicious installers designed to cripple core security functions on infected machines. The attackers specifically target users looking to obtain popular commercial applications, leading to widespread compromises across numerous industries. Reports indicate that the bulk of affected entities are China‑based operations within multinational corporations as well as individual Chinese‑speaking users ¹.

The technique hinges on an attacker‑controlled proxy server that intercepts legitimate HTTP/HTTPS traffic and replaces authentic digital certificates embedded in downloadable packages. By doing so, the malware can sign its own installer files under the guise of reputable vendors such as Adobe Systems Incorporated—a method reminiscent of earlier supply‑chain incidents like CVE‑2019–0754, which exposed vulnerabilities in older Reader versions prior to DC19003. Because browsers and operating systems trust any certificate issued by a root Certificate Authority (CA) present in their store—even if that CA itself is compromised—the method effectively bypasses standard code‑signing verification mechanisms.

This circumvention forces defenders to adopt monitoring practices beyond simple signature checks. However, many smaller businesses lack dedicated IT staff or budget allocations for comprehensive oversight, leaving them especially vulnerable to this form of attack. Microsoft’s analysis underscores the need for enhanced vigilance when installing software from third‑party sites, even those claiming official vendor status ¹.

Supply‑chain attacks via distribution channels have become increasingly common since notable events such as the 2017 NotPetya outbreak, where Ukrainian tax accounting software served as the initial vector. Attackers frequently employ DLL sideloading tactics, injecting malicious code into legitimate system processes—an approach successfully leveraged against legacy operating systems lacking modern protections such as Credential Guard introduced by Windows Server 2016 ¹.

In practice, organizations should verify digital signatures across all installed components—not just those directly downloaded through an official vendor site—to guard against spoofed certificates. The campaign demonstrates how attackers can subvert trusted update mechanisms (such as Windows Update) and weaken built‑in defenses (like Microsoft Defender), thereby eroding user privacy and device integrity on a large scale.

The findings highlight the critical importance of continuous security hygiene: ensuring that installers are sourced only from verified vendors, maintaining up‑to‑date root CA stores, and deploying layered defense strategies capable of detecting anomalous certificate replacements before they compromise core OS functions. As these threats evolve, both corporate IT teams and individual users must remain vigilant—especially in regions with high volumes of multinational operations—where supply‑chain attacks continue to pose significant risks to online privacy and computer security.