Financially motivated threat actors misusing App Installer

Since mid-November 2023, Microsoft Threat Intelligence has observed threat actors, including financially motivated actors like Storm-0569, Storm-1113, Sangria Tempest, and Storm-1674, utilizing the ms-appinstaller URI scheme (App Installer) to distribute malware.

The post Financially motivated threat actors misusing App Installer appeared first on Microsoft Security Blog.

app app installer blog installer intelligence malware microsoft microsoft security microsoft threat intelligence ms-appinstaller november november 2023 security security blog storm tempest threat threat actors threat intelligence uri