Microsoft disables MSIX protocol handler abused in malware attacks

Microsoft disabled the ms-appinstaller (MSIX/App Installer) protocol handler after multiple financially motivated threat actors abused a known AppX Installer spoofing vulnerability (CVE-2021-43890) to deliver signed malicious MSIX packages that bypass SmartScreen and browser protections; observed activity includes distribution of Emotet and BazarLoader and links to ransomware deployment, with Microsoft recommending an App Installer update or disabling the protocol via Group Policy.