Microsoft Disables App Installer After Feature is Abused for Malware

Microsoft disabled the ms-appinstaller URI scheme after Microsoft Threat Intelligence observed financially motivated threat actors abusing the App Installer/MSIX handler to distribute signed malicious packages via deceptive search ads, SEO poisoning and phishing, delivering loaders, stealers, RATs and other malware families; Microsoft issued an update (addressing CVE-2021-43890) to disable the handler by default and recommends phishing-resistant authentication and user education to reduce risk.