Fake Software Installers Disable Windows Update and Weaken Microsoft Defender

Attackers are distributing trojanized software installers through fraudulent download sites, tricking users into running malware that deliberately disables Windows Update and degrades Microsoft Defender protections. This campaign, attributed to the Chinese threat cluster Silver Fox, exploits the common user behavior of seeking free or convenient software downloads from unverified sources. By crippling built-in defenses first, the malware ensures it can establish persistence and communicate with attacker infrastructure without triggering OS-level alerts. This matters because once core security controls like automatic patching and antivirus are neutralized, the victim's system becomes significantly easier to exploit further. Organizations that do not enforce software installation policies or monitor security configuration changes are especially vulnerable.