Loading story…
A user report alleges that Windows automatically installed an LG monitor-related application on systems connected to LG displays, likely through hardware metadata and a background Microsoft Store deployment process rather than a traditional user-initiated install. The software reportedly appeared as an LG Monitor App Installer and later showed a McAfee promotional pop-up even though McAfee was not installed on the affected system, raising concerns about transparency and user consent.
No malicious activity has been confirmed, and the behavior appears tied to legitimate OEM companion app distribution, but the unsolicited installation and advertising resembled patterns commonly associated with potentially unwanted programs. The reports say users can review Windows Reliability Monitor to confirm installation events and reduce similar behavior by blocking automatic downloads of apps associated with device metadata or restricting background Microsoft Store app deployments; Microsoft and LG had not issued public statements at the time of reporting.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
After the reported installation, the LG-associated app allegedly showed a McAfee advertisement even though McAfee was not installed, raising concerns about OEM app distribution resembling potentially unwanted software behavior.
A user report alleged that Windows Update or a related Microsoft Store background process automatically installed an LG monitor-related application on systems connected to LG displays without user consent.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Claims that **LG monitor companion software** for Windows may silently install advertising-related components have raised concerns about software delivered through trusted hardware ecosystems. Reporting said the issue appears tied to LG display management applications rather than the monitors themselves, with the alleged behavior including persistence through startup entries, scheduled tasks, registry changes, or background processes that could trigger pop-ups, notifications, altered settings, or software recommendations. LG had not publicly confirmed the claims, and the affected versions, regions, and installation packages remained unclear. The reports also revived scrutiny of a Windows Group Policy setting that can **prevent automatic download of applications associated with device metadata** under `Computer Configuration > Administrative Templates > System > Device Installation`. In a parallel discussion among system administrators, practitioners cited the LG allegations and earlier concerns such as **Razer Synapse** running with `SYSTEM` privileges as examples of why vendor-linked software delivery can expand enterprise risk. Commenters noted that while disabling metadata-driven app downloads may reduce exposure, **application control** remains the stronger mitigation against unwanted or overly privileged software.
Jul 25, 2026
Researchers reported an ongoing campaign of trojanized Microsoft Store utility apps that masqueraded as legitimate software such as **WinDirStat** and **LightShot** while covertly loading a Go-based backconnect/proxy payload. The Electron-based packages used Node.js foreign-function interfaces to load malicious DLLs, initially via `koffi` and later via `ffi-rs`, with observed filenames including `client.dll`, `telemetry.dll`, and patterned names such as `lib[A-Z0-9]{3}.dll`. Analysis of the payload found controller-driven HTTPS heartbeats, machine fingerprinting, and `yamux` multiplexing, indicating the apps were likely enrolling victim systems into a residential proxy or backconnect infrastructure. The operation appeared to evolve while retaining the same core behavior, with newly observed publisher identities including **TECHNOLOGIES FOR BUSINESS LLC** and **SOFTWARE MATTERS LLC** and command-and-control domains such as `gate1.storetelemetryapiapps.xyz`, `telemetrystoreapi1.xyz`, and `storetelemetryapi.xyz`. Investigators said the apps deceptively lured users with free software and did not clearly disclose that installed systems could be repurposed as proxy nodes, extending a broader campaign that researchers traced back to related activity seen before its Microsoft Store distribution.
Jul 7, 2026
Sophos X-Ops reported a malicious Windows backdoor that was discovered after a false-positive review of an executable signed with a valid **Microsoft Windows Hardware Compatibility Publisher** certificate. The malware appeared to impersonate **Thales**, installed itself as a service named `CatalogWatcher`, embedded the **3proxy** proxy server, and used an XOR-obfuscated command-and-control domain, `catalog[.]micrisoftdrivers[.]com`. Sophos said the abuse was serious because the trusted signature could help the malware evade scrutiny and blend into enterprise environments. Telemetry and VirusTotal data linked the backdoor to the **LaiXi Android Screen Mirroring** product, with related samples dating back to at least January 2023 across four compilation clusters that included signed and unsigned variants. Sophos said it found no evidence that LaiXi’s developers intentionally shipped the malware or that a broader supply-chain compromise had occurred, but urged caution because the association persisted over time. Microsoft was notified through the Microsoft Security Response Center and later added the affected files to its revocation list under **`CVE-2024-26234`**.
Jun 29, 2026