Installing Software Shouldn’t Be This Risky

Installing software feels like one of the safest things you can do.

You need a tool.
You download it.
You install it.
You get on with your day.

That’s how it’s supposed to work.

But increasingly, that’s exactly where problems start.

The attack that doesn’t look like an attack

We’re seeing more and more cases where the compromise begins with something completely routine:

Installing software.

Not a suspicious file.
Not a phishing attachment.
Just something that looks legitimate.

The latest threat intelligence shows that trojanised installers are now a reliable and widely used attack method, because they rely on normal user behaviour.

That’s what makes them so effective.

What is a trojanised installer?

It’s simple.

You download what looks like:

• Microsoft Teams
• A PDF tool
• A browser update
• A supplier app

It installs… and it works.

But behind the scenes, something else is installed alongside it.

That could be:

• Remote access tools
• Password stealers
• Backdoors for later access

The report highlights that these installers often run in a trusted, user-approved context, which means they don’t raise immediate suspicion.

From the system’s point of view, everything looks normal.

Why this works so well in small businesses

Because it fits how people actually work.

Someone needs something quickly:

• A file viewer
• A plugin
• A mobile app
• A quick fix

They Google it.

They click the first result.

They install it.

Job done.

Except it isn’t.

The problem isn’t the install. It’s the trust.

Once that software runs:

• It may have admin rights
• It may access files
• It may communicate externally

…and because it was installed by a user, it’s trusted.

The report shows attackers are deliberately using trusted workflows and user-driven actions to get around traditional security controls.

That includes software installation.

What happens next

After installation, the attacker doesn’t rush.

They:

• Check what access they have
• Look for credentials
• Identify systems and users
• Prepare for the next step

All quietly.

Often using built-in tools and legitimate processes.

Which means:

No obvious alert
No immediate disruption
No clear sign something is wrong

Until later.

Why traditional approaches struggle here

Most businesses rely on:

• Antivirus
• Basic filtering
• User trust

The problem is:

Antivirus often looks for known threats.
These installers behave like normal software.

Filtering focuses on emails.
This often starts with a web search.

User trust is the entry point.
That’s what’s being exploited.

What actually reduces the risk

This is where things need tightening up.

Not completely locking everything down.

Just adding control where it matters.

1. Control what can be installed

Not every device needs to install anything at any time.

Application control helps:

• Allow approved software
• Block unknown or risky applications
• Reduce the attack surface massively

2. Manage privileges properly

One of the biggest risks is admin rights.

If users can install anything freely, the door is wide open.

Heimdal’s PEDM approach allows:

• Temporary admin access when needed
• Automatic removal of privileges afterwards
• Full control over who can run what

That reduces long-term exposure significantly.

3. Keep software properly patched

A lot of attacks don’t even need a fake installer.

They just exploit outdated software.

Heimdal’s patch and asset management:

• Gives full visibility of installed software
• Automates updates across systems
• Reduces the window of vulnerability

Patches can be deployed in under 4 hours, significantly reducing risk exposure.

4. Know what’s actually on your devices

Most businesses don’t have a clear inventory of:

• Installed applications
• Versions
• Risks

That’s a problem.

Because you can’t control what you can’t see.

5. Detect what slips through

Even with controls in place, things happen.

This is where EDR comes in:

• Detect unusual behaviour
• Stop suspicious activity
• Respond quickly

Because the earlier you catch it, the smaller the impact.

The real takeaway

Installing software shouldn’t be risky.

But right now, it is.

Not because people are careless.

Because attackers are using the same shortcuts everyone else does.

A better way to think about it

Instead of:

“Don’t install anything”

It becomes:

“Install safely, with the right controls around it”

That’s a much more realistic approach for most businesses.

If you want to take a closer look

We help businesses across Chesterfield, Sheffield, and beyond put sensible controls around software, devices and user access.

No unnecessary restrictions.

Just the right balance between usability and protection.

If you want to understand where your gaps might be, we can talk it through.