We're gradually updating threat actor names in our reports to align with the new weather-themed taxonomy. Learn about Microsoft threat actor names
Behavior:Win32/MaleficAms.A
Aliases: No associated aliases
Summary
Behavior:Win32/MaleficAms is an advanced Trojan that infects devices using various deceptive methods. It often disguises itself as legitimate software or is bundled with seemingly safe downloads from unreliable sources, such as freeware platforms or pirated software websites. Once the infected program is installed, MaleficAms runs a malicious PowerShell script that modifies key system settings—such as Group Policies and registry entries—to maintain persistence and weaken security measures. It can also exploit vulnerabilities in outdated software or operating systems to silently infiltrate systems without any user action.
Microsoft Defender Antivirus automatically removes threats as they are detected. However, many infections can leave remnant files and system changes. Updating your antimalware definitions and running a full scan might help address these remnant artifacts.
You can also visit our advanced troubleshooting page or search the Microsoft virus and malware community for more help.
