Microsoft Disabled App Installer After Threat Actors Misused It

Since mid-November 2023, Microsoft Threat Intelligence has noted various threat actors, including those with financial motives, using malware distribution tactics. They exploit the Microsoft App Installer protocol handler to distribute malware, potentially leading to ransomware. These methods allow threat actors to circumvent safety mechanisms like Microsoft Defender SmartScreen and browser warnings for executable file downloads. Microsoft suggests several mitigation strategies to counter this threat.