Microsoft disables one of its own software tools following multiple malware attacks

Microsoft has disabled the ms-appinstaller protocol handler after discovering hackers using it to distribute malware. The firm also found hackers selling malware kits on the dark web that use the MSIX file format and the ms-appinstaller protocol handler. At least four cyber threat actors have been identified as having exploited the App Installer service. The handler has been disabled in App Installer version 1.21.3421.0 or higher.