Distribution of MSIX Malware Disguised as Notion Installer

**Executive Summary:** An MSIX installer spoofing the Notion installer, signed with a legitimate certificate and hosted on cloned sites, installs an obfuscated refresh.ps1 which fetches a .NET payload (1.dat) from a C2 (e.g., fleetcontents.com); the .NET payload uses process hollowing to inject LummaC2 into RegAsm.exe, enabling browser, cryptocurrency, and file theft—the report includes MD5 hashes and malicious URLs as IOCs and warns about signed MSIX abuse.