[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f_Kgk5O5QigbTLOjRV-OUt7qp2Nu7jSLKGTGN17zwNiY":3},{"article":4,"iocs":48,"watch_terms":85,"solutions":86,"lesson":173},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"4e4390bc-5dc4-4f10-94e6-5fdd258d050f","Fake Software Installers Disable Windows Update and Weaken Microsoft Defender","fake-software-installers-disable-windows-update-and-weaken-microsoft-defender-64ac10","An active malware campaign is using bogus software-download websites to impersonate trusted vendors and distribute malicious installers. \"The campaign has targeted users looking to download popular software and has resulted in compromises across multiple organizations and industries, primarily affecting China-based operations of multinational organizations and Chinese-speaking users,\" Microsoft","A malware campaign is using fake software download websites to distribute malicious installers that disable Windows Update and weaken Microsoft Defender. The campaign, potentially linked to the Chinese threat cluster Silver Fox, targets users looking for popular software and has impacted various industries, primarily affecting China-based operations. The malware establishes persistence, modifies security settings, and communicates with attacker-controlled infrastructure.","Fake software installers are disabling Windows Update and weakening Microsoft Defender.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Ffake-software-installers-disable.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjhKCtgI2bIF4kLY71qjkluS80XAm5YPA9y9GzTxC8XBTaxq1d42jyZ-bxAr7OlZ-wCc4-RDp_NmUPKxd9TS1dvtjt3gysB86SkMuQ5q6vGb7HTh-DVMNC8VJcJFC2sJmiSQ740SX-miCoyiGfkAXLqO1ySH3zenWcAP7g6ilReO9jRsnl3Tnw279K7NYF3\u002Fs1600\u002Fwindows-updates.jpg","2026-09-02T16:41:06+00:00","2026-09-02T18:00:11.211048+00:00",9,[17,20,22],{"name":18,"type":19},"Silver Fox","threat_actor",{"name":21,"type":19},"Yinhu",{"name":23,"type":24},"Microsoft","vendor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":25,"icon":27,"name":28,"slug":29},null,"Malware","malware",[31,36,41,43],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":42},{"id":25,"icon":27,"name":28,"slug":29},{"category":44},{"id":45,"icon":27,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49,53,56,58,61,63,65,67,69,71,73,75,77,79,81,83],{"type":50,"value":51,"context":52},"domain","gehie246.com","Domain used to download malicious ZIP archives.",{"type":50,"value":54,"context":55},"iualef.net","Command and control (C2) domain associated with the campaign.",{"type":50,"value":57,"context":55},"oijfwe.net",{"type":50,"value":59,"context":60},"app-microsoft-edge.com.cn","Example of a counterfeit website domain.",{"type":50,"value":62,"context":60},"baidu-pan.com.cn",{"type":50,"value":64,"context":60},"calibre-ebook.com.cn",{"type":50,"value":66,"context":60},"cn-drawio.com.cn",{"type":50,"value":68,"context":60},"gw-sogou.com.cn",{"type":50,"value":70,"context":60},"kaspersky-lab.hl.cn",{"type":50,"value":72,"context":60},"mindmoster.com.cn",{"type":50,"value":74,"context":60},"ocam-pc.com.cn",{"type":50,"value":76,"context":60},"pc-razerzone.com.cn",{"type":50,"value":78,"context":60},"sejda.hl.cn",{"type":50,"value":80,"context":60},"steelseries-cn.com.cn",{"type":50,"value":82,"context":60},"translate-youdao.hl.cn",{"type":50,"value":84,"context":60},"zh-diskgenius.com.cn",[23],{"controls":87,"vendors":168},[88,116,145],{"slug":89,"name":90,"problem":91,"products":92},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":110,"vendor_name":23,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"slug":117,"name":118,"problem":119,"products":120},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[121,129,137],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-swg","Netskope Secure Web Gateway","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fnext-gen-swg","Cloud secure web gateway with inspection of web and cloud app traffic.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-internet-access","Zscaler Internet Access","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fzscaler-internet-access","Cloud secure web gateway with DNS security, inspection and data protection.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-gateway","Cloudflare Gateway","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fgateway\u002F","DNS filtering and secure web gateway.",{"slug":146,"name":147,"problem":148,"products":149},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[150,156,163],{"vendor_slug":151,"vendor_name":152,"vendor_logo":153,"product_slug":151,"product_name":152,"url":154,"description":155},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":157,"vendor_name":158,"vendor_logo":159,"product_slug":146,"product_name":160,"url":161,"description":162},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":164,"product_name":165,"url":166,"description":167},"managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",[169],{"slug":110,"name":23,"logo_path":111,"roles":170},[171,172],"reported_by","affected",{"slug":174,"title":175,"body":176,"framework_refs":177,"framework_notes":189},"fake-installers-sabotage-windows-update-and-defender-to-persist-undetected","Fake Installers Sabotage Windows Update and Defender to Persist Undetected","Attackers are distributing trojanized software installers through fraudulent download sites, tricking users into running malware that deliberately disables Windows Update and degrades Microsoft Defender protections. This campaign, attributed to the Chinese threat cluster Silver Fox, exploits the common user behavior of seeking free or convenient software downloads from unverified sources. By crippling built-in defenses first, the malware ensures it can establish persistence and communicate with attacker infrastructure without triggering OS-level alerts. This matters because once core security controls like automatic patching and antivirus are neutralized, the victim's system becomes significantly easier to exploit further. Organizations that do not enforce software installation policies or monitor security configuration changes are especially vulnerable.",[178,179,180,181,182,183,184,185,186,187,188],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 7: Continuous Vulnerability Management","CIS Control 10: Malware Defenses","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity","NIST SP 800-53 SA-12: Supply Chain Protection","NIST CSF PR.IP-1: Baseline Configuration","MITRE ATT&CK T1562.001: Impair Defenses – Disable or Modify Tools","MITRE ATT&CK T1195: Supply Chain Compromise",{}]