Trojanized MSI Installer Masquerading as Microsoft FIXMAPI V1.0

Ethan Andrews@eandrews

•updated Jul 6, 2026•3•0•4

Detects the execution of a malicious MSI installer masquerading as a legitimate Microsoft FIXMAPI utility. The rule flags suspicious MSI command lines or the presence of the AICustAct.dll component (associated with Advanced Installer) within paths containing the misspelled publisher 'Microsoft Coporation' or the 'Microsoft FIXMAPI' utility string.