Financially motivated threat actors misusing App Installer

Microsoft Threat Intelligence observed since mid-November 2023 multiple financially motivated groups abusing the ms-appinstaller URI scheme and signed MSIX packages distributed via malvertising, SEO poisoning, and Microsoft Teams phishing to install loaders (BATLOADER, EugenLoader), backdoors (Carbanak, Gracewire), info-stealers, and ultimately enable ransomware (Black Basta, Clop); the report provides technical details, IOCs (hashes, domains, URLs), hunting queries, detections, and mitigation recommendations.