Chinese Threat Actors Use MSI Files to Bypass Windows, VT Detection

Chinese-language threat actors are increasingly distributing a stealthy MSI-based loader dubbed UULoader that evades static detection by stripping executable headers and using DLL sideloading; the loader runs decoy installers, registers Defender exclusions via VBScript, and ultimately drops Gh0stRAT and credential-stealing tools like Mimikatz, with a noted uptick in infections across Southeast Asia targeting Chinese- and Korean-speaking users.