A Windows 11 tool to enable the Google Play Store was actually malware

Microsoft launched Windows 11 late last year, and the most notable addition was Android app support via the Amazon AppStore. Users can sideload apps with some effort, but there were also several unofficial ways to install the Google Play Store.

One of these solutions, dubbed Windows Toolbox, installs the Play Store, debloats Windows 11, and offers several more features. However, Bleeping Computer has reported that Windows Toolbox actually infected users’ computers with malicious Chrome extensions, questionable scripts, and possibly other malware as well.

What does this tool actually do?

The outlet explained that the tool was actually a trojan that executed hidden PowerShell scripts. These scripts created scheduled tasks in Windows 11, such as killing processes and creating other tasks. It also created a hidden c:\systemfile folder and then copied the default Chrome, Edge, and Brave browser profiles to this folder.

A malicious Chromium extension was also created in this hidden folder, uploading the victim’s geographic information while also redirecting the user to affiliate and referral links. More specifically, Bleeping Computer reported that users visiting whatsapp.com would be redirected to URLs associated with “make money” scams, unwanted apps and games, and browser notification scams.

Users were advised to check for the existence of these suspicious scheduled tasks and the hidden systemfile folder if they thought their PC was infected. You’ll then want to delete the scheduled tasks, associated Python files, and the folder in question.

Either way, it’s clear that you should definitely express more caution when it comes to installing the Play Store on your Windows 11 device.

Next: How to factory reset Windows 11