THREATNOIR
Subscribe
Back to advisories

Fake Software Installers Disable Windows Update and Weaken Microsoft Defender

Malware disguised as legitimate software installers is actively disabling Windows Update and degrading Microsoft Defender protections. The campaign, potentially linked to Silver Fox, primarily targets China-based operations but affects multiple industries. Compromised systems establish persistence and maintain contact with attacker infrastructure.

HIGHAdvisorySep 03, 2026
Action required
Hunt for suspicious installer execution, disabled Windows Update services, and Defender configuration changes. Block known malicious domains and hash indicators of compromise. Scan endpoints for persistence mechanisms and verify Defender and Update services are running and functional.
Affected products
Microsoft
Linked articles
Source links