Installer masquerade is a social-engineering tactic in which malware is packaged to look like a legitimate software installer, updater, or setup wizard. The goal is to make the user trust the file enough to open it, enter a password, or approve security prompts. Because the disguise matches a normal workflow, the malicious code can reach the device before traditional antivirus or network defenses see much activity.
This tactic matters because installers often have elevated privileges and are expected to write files, launch helpers, or request permissions. Attackers exploit that trust boundary by mimicking well-known brands, signed app bundles, or routine update prompts. Defenders look for weak or missing code signatures, unusual download locations, mismatched file names, suspicious first-run behavior, and unexpected network connections after installation. User training also helps: verify the source, inspect the publisher, and treat any installer outside an official channel as untrusted.