Bogus download sites deploy malware that disables Windows protections

Microsoft reported an active malware campaign using counterfeit software-download sites to distribute malicious installers, primarily affecting China-based operations of multinational organizations and Chinese-speaking users. The malware establishes persistence, adds Microsoft Defender exclusions, disables Windows Update services, and contacts attacker-controlled infrastructure. Microsoft assessed with moderate confidence that the activity is consistent with the Silver Fox threat cluster and said automated containment was initiated through attack disruption.