SetupHijack Tool Abuses Race Conditions in Windows Installer to Hijack Setups

According to Hacker House, security researchers have released SetupHijack, a proof-of-concept tool that exploits race conditions and insecure file handling in Windows installers and updaters. It targets installers and updaters that drop files into world-writable locations such as %TEMP%, %APPDATA%, or the user’s Downloads folder, where temporary executables, MSI packages, or batch scripts are often written before being launched with elevated privileges.

SetupHijack continuously polls these directories and, upon detecting a new or modified installer file, replaces it with an attacker-controlled payload before the installer executes integrity checks, allowing the payload to run with elevated rights. The project describes how to install and build SetupHijack on Windows using a Makefile and standard tools, including compiling with nmake PAYLOAD="C:\Path\to\payload.exe" and generating a signed MSI installer via a hacked code-signing process.

In demonstrations, the tool has been shown hijacking Zoom’s update process by infecting temporary executables, illustrating how a threat actor could persist or deploy ransomware, though some apps like Visual Studio and Wireshark include checks that hinder such attacks.