A benign looking update Dragon Boss pushed out in March 2025 established persistence via scheduled tasks and arranged for future payloads to be excluded from Windows Defender.
'Harmless' Global Adware Transforms Into an AV Killer
Summary + source link. No paywalls, no tracking.