Side-Loading Attacks Are Sneakier Than They Sound. Here’s How to Stop Them.

Last updated: October 15, 2026

One attack method that's gaining traction is side-loading. It exploits a legitimate Windows feature—the ability to install apps from trusted sources—using apps that appear legitimate but carry a malicious payload. Sophos documented an attack that used a booby-trapped app hosted on the Microsoft Store. The app was later removed. Here's how it works and how to shut it down.

What Is Side-Loading?

Side-loading refers to installing applications outside the Microsoft Store, typically from third-party sources or custom installers. Windows allows this by default so businesses can deploy internal tools. Attackers abuse that trust by packaging malware inside what looks like a legitimate application installer.

The Sophos case used a crafted app hosted on the Microsoft Store. Users installed it expecting a normal tool. The app then installed ransomware on the local machine and spread across the network.

Third-party Office 365 applications have also been used to move laterally inside a network and steal information. The attack surface isn't just the desktop—it's anything users can authorize.

How to Block Side-Loading

Blocking with Intune

For organizations using Microsoft Endpoint Manager:

• Open Endpoint Manager Administration Center.
• Go to Devices, Configuration Profiles, and create a new profile.
• Select Windows 10 or later as the platform.
• Choose Device Restrictions (or use the template).
• Find the setting for trusted applications. Set it to Block.
• Assign the policy to users or groups.

Blocking means non-Microsoft Store applications cannot be installed. The setting accepts three values: Block, Allow, and NotConfigured. Block is the secure choice for most endpoints.

Blocking with Group Policy

If you're not using Intune:

• Navigate to Computer Configuration, Administrative Templates, Windows Components, App Package Deployment.
• Find and disable "Allow all trusted applications to install."
• Find and disable the development mode setting if it's enabled.

Disabling this policy prevents unapproved apps from installing. Note that it also blocks some legitimate internal tools, so test on a pilot group before rolling out broadly.

Registry Fix for Standalone Machines

For machines without Endpoint Manager or Group Policy:

• Open Registry Editor and navigate to HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Appx.
• Add a DWORD value named AllowAllTrustedApps.
• Set it to 0 to block side-loading, 1 to allow it.

Protecting Against Office 365 App Abuse

Third-party OAuth apps connected to your Microsoft 365 tenant can request permissions that escalate their access. To limit this:

• In the Microsoft 365 Admin Center, go to Organization Settings, Services.
• Find User Consent for Apps and switch to an administrator approval workflow.
• Require all third-party app requests to go through IT review before users can authorize them.

Our analysis

Side-loading protection isn't optional if your endpoints run Windows. The Sophos case used a store-hosted app that passed initial vetting—meaning simple installation-source controls aren't enough on their own.

The trade-off**: Blocking side-loading hardens your environment, but it can break legitimate line-of-business apps that rely on this feature. Organizations with custom internal tools need an exception process—maintain a list of approved apps and a workflow for users to request exceptions.

Who wins**: IT teams with Endpoint Manager or Group Policy in place can push blocks centrally and audit compliance. Smaller shops relying on manual registry edits get a quick fix but lose centralized visibility.

What to watch**: As Windows 11 adoption grows, Microsoft's security defaults are tightening—but enterprise environments often lag behind. Schedule quarterly reviews of your endpoint policies to catch drift. Also monitor Microsoft's trusted application guidance for any changes to how store apps are vetted.

User education remains the first line of defense. A cautious user who flags unusual app behavior stops most of these attacks before they spread.

Who should care

• IT admins managing Windows endpoints**: Block side-loading using whatever management tool you have in place.
• Security teams reviewing attack surface**: Third-party OAuth apps are an overlooked entry point—audit permissions regularly.
• End users**: Don't install apps outside the Microsoft Store unless IT has approved them. When in doubt, ask your help desk.

Key takeaways

• Side-loading lets attackers install malware through seemingly trusted apps.
• Intune, Group Policy, or a registry tweak can block non-Microsoft Store installations.
• Review OAuth app permissions in Microsoft 365 and require admin approval for third-party apps.
• User training matters more than any single policy setting.
• Build an exception process for legitimate internal tools before you block.