An MSI installer is a Windows Installer package, usually with the .msi extension, used to deploy, repair, or remove software on Windows systems. It tells the operating system what files to copy, what registry changes to make, and what installation steps to run. Because it is a standard enterprise format, MSI packages are often trusted by users and management tools.
That trust makes MSI a useful delivery vehicle for attackers. Malicious operators can hide payloads inside an installer, wrap a script or loader in a package that looks legitimate, or abuse msiexec.exe to launch code with the appearance of normal software installation. Defenders should treat unexpected MSI files as suspicious, verify digital signatures and publisher details, and monitor for unusual install activity, especially when an MSI appears alongside remote-support tools or scripting engines.