Skip to main content
MSRC

Malware

Microsoft addresses App Installer abuse

Thursday, December 28, 2023

28 October 2024 Update Microsoft disabled the ms-appinstaller URI scheme handler by default in App Installer on 28 December 2023 as a security response to protect customers from attackers’ evolving techniques against previous safeguards for CVE-2021-43890. Microsoft is pleased to announce that we have introduced new safeguards to the ms-appinstaller URI scheme handler by default in version 1.

Customer Guidance for the Dopplepaymer Ransomware

Wednesday, November 20, 2019

Microsoft has been investigating recent attacks by malicious actors using the Dopplepaymerransomware. There is misleading information circulating about Microsoft Teams, along with references to RDP (BlueKeep), as ways in which this malware spreads. Our security research teams have investigated and found no evidence to support these claims. In our investigations we found that the malware relies on remote human operators using existing Domain Admin credentials to spread across an enterprise network.