Microsoft disables MSIX protocol handler abused in Emotet attacks

Microsoft has disabled the MSIX ms-appinstaller protocol handler exploited in malware attacks to install malicious apps directly from a website via a Windows AppX Installer spoofing vulnerability.

Today’s decision comes after the company released security updates to address the flaw (tracked as CVE-2021-43890) during the December 2021 Patch Tuesday and provided workarounds to disable the MSIX scheme without deploying the patches.

The likely reason for disabling the protocol altogether is to protect all Windows customers, including those who haven’t yet installed the December security updates or applied the workarounds.

“We are actively working to address this vulnerability. For now, we have disabled the ms-appinstaller scheme (protocol). This means that App Installer will not be able to install an app directly from a web server. Instead, users will need to first download the app to their device, and then install the package with App Installer,” said Microsoft Program Manager Dian Hartono.

“We recognize that this feature is critical for many enterprise organizations. We are taking the time to conduct thorough testing to ensure that re-enabling the protocol can be done in a secure manner.

“We are looking into introducing a Group Policy that would allow IT administrators to re-enable the protocol and control usage of it within their organizations.”

How threat actors abused ms-appinstaller to push malware

As BleepingComputer reported, Emotet started spreading and infecting Windows 10 and Windows 11 systems in early December using malicious Windows AppX Installer packages camouflaged as Adobe PDF software.

Emotet’s phishing emails used stolen reply-chain emails and instructed potential victims to open PDFs related to the previous conversation.

However, when clicked, links embedded in the emails will redirect the recipients onto pages that, instead of opening the PDF, would launch the Windows App Installer program and ask to install an “Adobe PDF Component.”

While it looks like a legitimate Adobe app, App Installer will download and install a malicious appxbundle hosted on Microsoft Azure when the user clicks the Install button.

You can find more information, including the way Emotet abused the built-in Windows App Installer feature during the campaign, in our previous report.

This AppX Installer spoofing vulnerability was also exploited to distribute the BazarLoader malware via malicious packages hosted on Microsoft Azure, using *.web.core.windows.net URLs.