A decoy installer is a legitimate setup file bundled with a malicious package to make it look harmless. The decoy may install a real, known application or a harmless component, creating a trustworthy appearance while a separate malicious layer runs in the background. In practice, this is a form of social and technical camouflage: the visible file is benign, but the surrounding package is not.
Decoy installers matter because defenders and users often judge a download by its contents at a glance. A familiar installer, valid icon, or signed package can reduce suspicion and help malware pass quick review. Attackers use decoys in trojanized archives, repackaged software bundles, and fake update packages. Defenders should inspect the full container, verify hashes and signatures, compare package behavior to expected software, and analyze whether the installer launches additional code or drops unexpected files. A clean-looking installer does not prove the package is safe.