A supply chain threat exists where connecting certain LG monitors to a Windows PC causes Windows Update to silently install LG software packages, which then automatically deploy unwanted adware, primarily promoting McAfee antivirus trials. The attack vector leverages the trusted Windows Update mechanism to install the initial LG components without user consent, after which the bundled installer runs promotional pop-ups persistently across system reboots. No CVSS score, specific affected monitor models, fixed versions, or official workarounds are provided in the source article.
Well, this is new – but not at all unexpected considering the state of Windows and the wider technology industry. When you connect certain LG monitors to a Windows machine, Windows Update will pull in a bunch of adware promoting antivirus trash. Of course, all done without any consent, because Silicon Valley inherently does not understand nor respect consent. Windows Update first installed LG extension and software component packages. Windows Reliability Monitor showed that LG Monitor App Installer appeared one minute later. The installation did not display a consent prompt or require the user to approve the download. Gamers Nexus tested the application across 32 consecutive system boots. It displayed a McAfee promotion during 31 of them. On the remaining boot, it promoted one of LG’s own monitor utilities. The McAfee popup offered a 30-day trial that would convert into a paid subscription. ↫ WhyCry at VideoCardz Don’t use Windows.