Microsoft patches vulnerability in Windows AppX Installer being used to spread Emotet malware

This vulnerability, tracked under code CVE-2021-43890, is related to Windows AppX Installer spoofing. Cybercriminals can remotely exploit this vulnerability with low user privileges. However, for successful exploitation, it is necessary to organize attacks of high complexity and require user (victim) interaction.

"We investigated reports of a rogue vulnerability in AppX Installer affecting Microsoft Windows. Microsoft discovered attacks attempting to exploit this vulnerability with specially crafted software packages. especially, including the famous Emotet malware," Microsoft shared.

According to Microsoft, hackers will create an attachment containing malicious code to use in phishing campaigns. Next, the hacker will spread this attachment in spam emails with content that entices users to open them.

Microsoft patches vulnerability in Windows AppX Installer being used to spread Emotet malware Picture 1

How to not be affected by Windows AppX Installer vulnerability?

To prevent hackers, Windows users need to install a patched version of Microsoft Desktop Installer on their platform:

Microsoft Desktop Installer 1.16 for Windows 10 version 1809 or later
Microsoft Desktop Installer 1.11 for Windows 10 version 1709 or 1803

Microsoft also provides mitigations for customers who are unable to immediately install Microsoft Desktop Installer updates.

Those measures include enabling BlockNonAdminUserInstall to prevent non-Administrator users from installing Windows App packages and AllowAllTrustedAppToInstall to block installs from apps outside of the Microsoft Store.

Micah Soto

Update 16 December 2021

You should read it

May be interested

How to turn off Windows Installer to block MSI package
windows installer is a background service, which manages the installation and uninstallation of msi-based programs. to block the msi installer, you can turn off windows installer using group policy or edit the registry.
Serious vulnerability in Microsoft Word is being used by hackers to install malware on computers
a zero day vulnerability in microsoft word is being exploited to install malware on windows machines.
The spread of malware and how to prevent it
you often don't understand why viruses can infect your computer even though you have installed antivirus. so which routes have they spread and how to prevent them?
Winos 4.0 Malware Warning: Protect Your Computer From Fake NSIS Installers!
stealthy winos 4.0 malware variant is using a rogue nsis installer to launch multi-stage attacks.
The unpatched Microsoft Word DDE vulnerability is exploited in a massive malware attack
a new attack method that exploits the microsoft office integration feature has been discovered being used for malware distribution campaigns.
A new kind of malware is spreading through Messenger and Skype spam messages
recently, network security experts at avast security have warned of a new malware that attacks computers in two steps and spreads through messaging services like facebook messenger and skype.
Windows 7 users need to install Microsoft patches immediately to fix BlueKeep security errors
today, windows 7 or older users need to install important patches to fix recently discovered security bugs on older windows versions.
Microsoft released an emergency security patch for a serious vulnerability
if you are using windows os, install this security patch now.
Fix Opera installer crashes downloading on Windows
like many other software programs, opera occasionally encounters technical problems. a common problem is when the installer gets stuck downloading on a windows system.
Detecting malware infection campaign hidden in fake Windows 11 installer
international security researchers have just issued an urgent notice about a sophisticated malicious attack campaign targeting windows users worldwide.