What changed

Microsoft published the campaign research on 1 September 2026. Its summary states that the activity impersonates legitimate software vendors to deliver malware through look-alike download pages and regenerated installer archives. Cloned brands named in the research include Razer, Microsoft Edge, Kaspersky, Sejda PDF, DiskGenius, draw.io, SteelSeries, Calibre and MindMaster. The published attack chain runs from a spoofed vendor site to a downloaded archive, extraction with an ordinary system archiver, a bundled wrapper that launches randomised payloads, persistence through scheduled tasks with benign-sounding names, and then the defensive step that matters here: broad Microsoft Defender path exclusions added through PowerShell, volume shadow copies deleted, and Windows Update services disabled, followed by callbacks to attacker infrastructure on non-standard ports. Microsoft records a characteristic re-execution cadence of roughly sixty seconds through Task Scheduler, and notes that payloads are regenerated server-side per request, so the same filename carries a different hash on each download. On targeting, Microsoft is specific and this article does not go beyond it: confirmed activity spans healthcare and medical devices, manufacturing, gaming, technology, logistics, government and higher education, with a primary focus on China-based operations of multinational organisations and Chinese-speaking users.

The risk is not that tamper protection is switched off, because in most managed estates it is switched on and has been for years. The risk is that it is switched on, reported as compliant, and not covering the one thing this campaign actually does. Microsoft protects antivirus exclusions from tampering only where a specific set of conditions is met, and one of those conditions is a device-management model that a large number of South African organisations do not currently have, because they are part-way through a move from Configuration Manager to Intune and are running both. A control believed to be in place and not in place is worse than a control known to be absent, because nobody is looking at it.

What the term means in plain language

Tamper protection is a Microsoft Defender for Endpoint capability that stops certain security settings being changed, whether by a user, an administrator or a process running as SYSTEM. It keeps real-time protection, behaviour monitoring, cloud protection and security intelligence updates enabled, and it is turned on by default for enterprise customers as part of built-in protection. Antivirus exclusions are a separate matter. An exclusion tells Defender not to scan a path, a process or a file type; it is a legitimate operational tool and it is also the single most valuable thing an attacker can write, because it converts a monitored machine into an unmonitored one without disabling anything visible. Microsoft protects exclusions from tampering under a narrower set of conditions than it protects the core settings, and the difference between the two is the subject of this article.

This distinction matters because product status is not the same as business readiness. Availability, support and compatibility are separate questions. A service can be available but unsupported, supported but capacity-constrained, or technically updated while a customer-specific process has stopped working.

Why this matters to a South African organisation

South African teams often operate with tight specialist capacity, rand-sensitive budgets and business processes that cannot be paused while a replacement is sourced. Localisation, regional cloud capacity and long procurement lead times can narrow the recovery options. The practical response is to use the available test window before it becomes an emergency window.

The consequence belongs to the business process, not only the technology team. Finance month-end, customer transactions, data pipelines and ERP extensions all cross technical and operational ownership. A change should therefore be accepted only when the service owner and the business owner can see the same evidence.

The hidden exposure

Microsoft Threat Intelligence published research on 1 September 2026 into a campaign that distributes malware through counterfeit software download pages impersonating real vendors. Once run, the installer adds Microsoft Defender exclusion paths, deletes shadow copies and disables Windows Update. Microsoft recommends enforcing tamper protection because it blocks Defender writes even at SYSTEM level. The documentation adds a condition the recommendation does not: exclusions are tamper protected only on devices managed by Intune only or Configuration Manager only, and co-managed devices are not supported.

Normal operation is weak evidence. It proves only that yesterday’s combination of platform, configuration and workload completed. It does not prove that the next capacity allocation, lifecycle enforcement or major release will preserve the same result. An owner needs an inventory, a representative test and a dated decision.

Decision path

Take the mitigation seriously and then check that it is doing what you think. Microsoft’s own recommendation for this campaign is to enforce tamper protection, and the reason given is exact: it blocks exclusion and registry writes to Microsoft Defender even when the payload runs as SYSTEM. That is precisely the step the malware takes, so the recommendation is well aimed. The question worth an hour this week is whether it applies to your estate in the way the sentence implies. The tamper protection article lists exclusions among the settings that cannot be modified or added while tamper protection is on, and then immediately qualifies it: under certain conditions, tamper protection can protect exclusions. The conditions are set out on the Intune management page and all four must hold. Devices must run a recent Defender platform version; DisableLocalAdminMerge must be enabled so that local settings do not merge with organisational policy; exclusions must be managed in Intune or Configuration Manager; and the device must be managed in Intune only or Configuration Manager only, with Sense enabled. The same page states plainly that co-managed devices are not supported for this feature. That last condition is the one that decides the answer for most organisations we work with, because co-management is the normal state of an estate moving from Configuration Manager to Intune, and that migration is a multi-year piece of work in most South African businesses of any size. This is our reading rather than Microsoft’s, and it is the reason we would check rather than assume. The second decision is about detection strategy, and it follows from one line in the research. Because the payload is rebuilt on the server for every request, the same filename carries a different hash every time it is downloaded, so a hash-based blocklist has nothing durable to hold. Detection has to rest on behaviour and prevalence, which is what Microsoft’s recommended attack surface reduction rules are for, and on the tamper sequence itself: a SYSTEM scheduled task writing a Defender exclusion path and then deleting itself is a high-fidelity signal that almost nothing legitimate produces.

Record the alternatives that were rejected and why. That prevents the next reviewer from reopening the entire question without context. Where the preferred path cannot be completed inside seven days, approve a time-bound exception with a responsible owner, expiry date and compensating control.

Technical test plan

Start with the state of tamper protection itself, which is answered per device by the Get-MpComputerStatus PowerShell cmdlet: the IsTamperProtected property returns true where it is enabled. That establishes the baseline and it is not the same question as whether exclusions are covered. For exclusions there is a single readable value. Open Registry Editor in read-only mode and check TPExclusions under HKLM\SOFTWARE\Microsoft\Windows Defender\Features. Microsoft documents 1 as meaning the required conditions are met and exclusion protection is enabled on the device, and 0 as meaning tamper protection is not currently protecting exclusions there. If the value is 0 and you believe every requirement is met, Microsoft directs you to support rather than to a fix. Where it reads 0, two further values explain why. ManagedDefenderProductType, under HKLM\SOFTWARE\Microsoft\Windows Defender, returns 6 for a device managed with Intune only and 7 for one managed with Configuration Manager. Where it is 7, EnrollmentStatus under HKLM\SOFTWARE\Microsoft\SenseCM distinguishes the two cases that matter: 4 means Configuration Manager alone, which meets the requirement, while 3 means co-managed with Configuration Manager and Intune, which Microsoft records as not supported for exclusion tamper protection. Any other value for the product type means the device is managed by neither exclusively and exclusions are not tamper protected. Microsoft warns twice, in bold, that these keys are for viewing only and that changing them has no effect on whether tamper protection applies. Read them; do not write them. Two further configuration points sit behind the registry reading. Where Intune manages Defender settings, Microsoft states that DisableLocalAdminMerge should be set to true so that locally defined lists do not merge with organisational policy, and that setting is one of the four documented conditions. And where Configuration Manager is the sole tool managing exclusions and all conditions are met, Microsoft is explicit that those exclusions are tamper protected and that pushing them through Intune as well is unnecessary. Separately, and worth knowing before your console changes under you: Microsoft is introducing a capability called controlled configuration, and the existing tamper protection setting in management experiences is being renamed to match it. The documentation states that current functionality and behaviour remain unchanged for existing deployments, and that organisations do not automatically receive controlled configuration protections as a result of the rename; it must be enabled explicitly through an Intune or Defender for Endpoint policy. A renamed setting that looks stronger and is not yet doing anything more is worth recognising for what it is.

Use production-representative conditions without exposing production data unnecessarily. Capture the starting configuration, exact version, time of test and expected result. A pass requires evidence from the real workflow, not only a successful login or an unchanged dashboard.

Primary owner

Primary owner: Whoever owns endpoint security policy, normally the Microsoft 365 or Intune administrator working with the security lead, together with whoever can answer how each device is actually managed today.

The named owner coordinates platform, application, commercial and business-process decisions. Contributors may perform the work, but accountability cannot be distributed across a meeting invite. The owner closes the test, exception and evidence record.

Action within seven days

Action within seven days: Read one registry value on a representative sample of devices this week: TPExclusions under HKLM\SOFTWARE\Microsoft\Windows Defender\Features. A value of 1 means antivirus exclusions are tamper protected on that device; 0 means they are not, whatever the tamper protection dashboard reports. Where the value is 0, establish which of the four documented conditions is unmet, and treat the device-management model as the first candidate. Read the value only. Microsoft states twice that changing these keys has no effect on whether tamper protection applies.

Start with the highest-consequence workload. Assign the people, date and pass criteria before the test begins. If the first test fails, record the failure as evidence and open remediation with a deadline rather than hiding it behind a general project status.

Evidence to retain

Evidence to retain: The dated TPExclusions readings across the sample, with the ManagedDefenderProductType and EnrollmentStatus values that explain them, the current tamper protection assignment from Intune or the Defender portal, and the list of Defender antivirus exclusions in force at the time of the reading. Together these record what the estate could and could not resist on the day the research was published.

Store the evidence with the platform or change record. Include source exports and machine-readable results where possible. The next reviewer should be able to reproduce the conclusion without rebuilding it from email, chat or memory.

Frequently asked questions

Is this campaign targeting South African organisations?

Microsoft does not say so. Its confirmed activity is described as spanning several sectors with a primary focus on China-based operations of multinational organisations and Chinese-speaking users, and the infrastructure and lure content described in the research are consistent with that. We are not going to inflate it. The reason it is worth thirty minutes here is the technique and the control, both of which are entirely portable: a counterfeit download page and an installer that writes its own antivirus exclusions work identically anywhere.

We have tamper protection on. Are we covered?

For the core Defender settings, yes. For antivirus exclusions, only if four documented conditions are all met, including that the device is managed in Intune only or Configuration Manager only. The TPExclusions registry value answers it per device, and it is the only answer we would rely on.

Why does co-management break this?

Microsoft does not explain the reason, it states the constraint: co-managed devices are not supported for the exclusion protection feature, and the registry table records a device with ManagedDefenderProductType 7 and EnrollmentStatus 3 as not supported. The practical consequence is what matters, and it is that a common migration state leaves a specific control inactive.

Can we just block the malicious files?

Not durably. Microsoft records that the payloads are regenerated server-side per request, so the same filename arrives with a different hash on every download. Hash-based blocking has nothing stable to match. Microsoft’s recommended attack surface reduction rules work on prevalence, age and behaviour instead, which is the right shape of control for this.

What does the malware actually do to Defender?

The research describes broad Microsoft Defender path exclusions added through PowerShell, alongside deletion of volume shadow copies and disabling of Windows Update services. It also describes temporary SYSTEM-level scheduled tasks created to make registry modifications, and a re-execution cadence of roughly sixty seconds through Task Scheduler.

Should we change the registry values if they read zero?

No. Microsoft states twice, and in a caution box, that changing these keys has no effect on whether tamper protection applies to exclusions. They are diagnostic. If the value is 0, the fix is in the management configuration, not in the registry.

What should we tell staff this week?

That software is installed from the vendor, reached through a known route, and not from a download page found in a search. This campaign does not need an exploit or an attachment; it needs somebody to look for a piece of software and take the first plausible result. That is a habit, and habits are changed by being named.

What is controlled configuration?

A new Microsoft Defender for Endpoint capability that builds on tamper protection, and the reason the tamper protection setting is being renamed in management experiences. Microsoft states that existing functionality and behaviour are unchanged and that the protections are not received automatically as a result of the rename: a controlled configuration policy has to be deployed through Intune or Defender for Endpoint security settings management.

The Braintree view

Microsoft’s announcement supplies the platform fact. The customer control begins after that fact: identify the exposed process, name the owner, test the real dependency and retain a decision that can survive audit or staff turnover. Braintree can help structure the inventory, build the representative test and translate the result into a controlled implementation plan.

Use the seven-day action as the entry point. Do not wait for a renewal, support refusal or enforced update to reveal work that can be measured now.