The Rise Of Malicious MSIX File

The talk looks at MSIX, the packaging format Microsoft introduced in 2018 as a successor to MSI, and at how criminals have started using it to deliver malware. An MSIX file is a ZIP archive holding XML manifests, application files, a block map and a signature. Its execution is driven by the Package Support Framework, which can run PowerShell scripts named in a start script. The presenters noted that almost all malicious MSIX samples they studied relied on this framework.

The main case is a financially motivated group the presenters call Steel Clover, which distributes banking trojans and information stealers through fake software download sites that appear as sponsored search results. The operators have impersonated popular tools, including ones tied to AI chatbots, and have used MSIX packages since early 2023. Their infrastructure is concentrated on a small set of IP addresses, and the same signatures were reused for a period of time.

For defenders, the presenters described file creation rules for extracted PowerShell scripts, which they said over-detect because legitimate applications also use MSIX. They preferred process-based rules keyed on the App Installer executables, which they found far more precise, along with network detections for the follow-on malware. Their advice covers checking download sources, restricting MSIX execution to trusted publishers, and sharing signatures and indicators with peers.