Microsoft disables MSIX protocol handler abused in Emotet attacks

Topic

New Reply

https://www.bleepingcomputer.com/news/microsoft/microsoft-disables-msix-protocol-handler-abused-in-emotet-attacks/

I guess does anything else legitimate use that in its update mechanism as now it won’t update – or at least

“The likely reason for disabling the protocol altogether is to protect all Windows customers, including those who haven’t yet installed the December security updates or applied the workarounds.”

 

Reply | Quote

Replies

While it looks like a legitimate Adobe app, App Installer will download and install a malicious appxbundle hosted on Microsoft Azure when the user clicks the Install button.

This AppX Installer spoofing vulnerability was also exploited to distribute the BazarLoader malware via malicious packages hosted on Microsoft Azure, using *.web.core.windows.net URLs…

Microsoft doesn’t scan/audit every file, app,.. uploaded to AZUR for scam, malware…?

Reply | Quote