NUMOZYLOD Malware Exploits MSIX Installers for Dangerous Code Execution

Recent campaigns attributed to UNC4536 distribute trojanized MSIX installers via malvertising; these packages use the Package Support Framework to run a PowerShell wrapper (NUMOZYLOD/Refresh2.ps1) which disables security controls, downloads secondary payloads (including CARBANAK and LUMMASTEALER), and uses techniques such as runFullTrust, DLL search-order hijacking, and multi-layer obfuscation to evade detection. The activity reflects MaaS-style operations supplying varied malware to criminal partners and highlights detection opportunities around MSIX artifacts, unusual PowerShell execution, VFS interactions, and AMSI/ScriptBlock logging anomalies.