Loading story…
A malicious spam campaign delivered BazarLoader by abusing the Windows 10 App Installer mechanism through links using the ms-appinstaller URI scheme. The operation used personalized complaint-themed lures and hosted malicious .appinstaller and .appxbundle files on Microsoft cloud storage, presenting victims with a fake Adobe-branded installer signed with a certificate linked to Systems Accounting Limited while falsely displaying Adobe Inc. as the publisher.
After installation, the payload SecurityFix.exe downloaded and executed a DLL via regsvr32.exe, used delayed execution and process spawning to evade detection, and injected into a headless msedge.exe process to start command-and-control traffic. Sophos said the malware matched BazarBackdoor behavior, including HTTPS cookie-based C2, PowerShell and native-command system profiling, and checks of external services to identify the victim network’s public IP address; Microsoft later tracked the App Installer issue as CVE-2021-43890 and fixed it in a subsequent Patch Tuesday release.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft released a fix for CVE-2021-43890 as part of its January 2022 Patch Tuesday updates. The patch addressed the App Installer vulnerability exploited to deliver BazarLoader.
Microsoft assigned CVE-2021-43890 to the Windows App Installer issue abused in the BazarLoader campaign. The vulnerability tracked the abuse of the App Installer mechanism that enabled delivery of the malicious package.
Sophos documented a malicious spam campaign delivering BazarBackdoor/BazarLoader via complaint-themed lures and links using the ms-appinstaller URI scheme. The attack hosted malicious .appinstaller and .appxbundle files on Microsoft cloud storage and used a fake Adobe-branded installer to launch the malware chain.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft reported a multi-stage malware campaign that used **WhatsApp messages** to trick targets into opening malicious **Visual Basic Script** (`.vbs`) files. The activity, observed from late February 2026, relied on social engineering and trusted cloud infrastructure including **AWS S3**, **Tencent Cloud**, and **Backblaze B2** to host follow-on payloads. After execution, the malware created hidden folders under `ProgramData`, downloaded additional VBS components, and used renamed legitimate Windows utilities to blend into normal system activity. The intrusion chain then attempted **UAC bypass**, registry changes for persistence, and deployment of unsigned MSI installers including `Setup.msi`, `WinRAR.msi`, `LinkPoint.msi`, and `AnyDesk.msi`, which provided remote access and backdoor capability on compromised systems. Microsoft said the attackers abused living-off-the-land techniques such as renaming `curl.exe` and `bitsadmin.exe` while leaving original PE metadata intact, giving defenders a detection opportunity; the company also linked the activity to command-and-control domains **`neescil.top`** and **`velthora.top`** and published indicators, file hashes, and hunting guidance for defenders.
Jun 29, 2026
Expel reported that the malware operation it tracks as **BaoLoader** abused at least 26 code-signing certificates over roughly seven years to make malicious software appear legitimate, tying **AppSuite-PDF**, **PDF Editor**, **ManualFinder**, **PDFTools**, **PDFProSuite**, **OneStart**, and related installers to the same actor cluster. The activity was linked to repeated business registrations and certificate purchases from multiple certificate authorities, with a notable concentration of entities in **Panama** and **Malaysia**, allowing the operators to continue signing new payloads after earlier certificates were revoked. The reporting indicates BaoLoader has often been misclassified as a potentially unwanted program and at times confused with **ChromeLoader** and **TamperedChef**, but certificate patterns, installer behavior, and campaign history point to a distinct malware ecosystem. Additional analysis of **AppSuite PDF Editor** and **OneStart** supports the broader picture of deceptive software installers and backdoor-capable delivery chains, while Expel said code-signing irregularities and certificate reuse remain key hunting signals for defenders tracking the operation.
Aug 14, 2026
Threat actors distributed a trojanized **Windscribe VPN** installer that paired the legitimate application with malicious components to covertly infect Windows systems. The package dropped the real VPN installer alongside a malicious executable, `lscm.exe`, and a VBS launcher, `win.vbs`, so the visible software installation could conceal background malware activity. Trend Micro reported that the installer was obtained from fraudulent sources rather than Windscribe’s official download channels or legitimate app stores. During execution, the malware retrieved an encrypted payload named `Dracula.jpg`, passed it through multiple layers of obfuscation and decryption, and installed **`Backdoor.MSIL.BLADABINDI.THA`**. The backdoor gave attackers the ability to download, execute, and update files, capture screenshots, and collect host details including the machine name, operating system, username, and installed antivirus products, providing broad remote access and reconnaissance capability on compromised hosts.
Aug 14, 2026