Windows application package files (.APPX) are the installation system used to install Universal Windows Platform apps. Similar to other installer types, such as MSI files, APPX files are created to provide the simple distribution and installation of software . However, these have recently been abused by what we track as an emerging and financially motivated cybercriminal group distributing BazaarLoader/Emotet malware. In this presentation, we will show how we identified and tracked this activity, take a dive into malware analysis of the observed campaigns, discuss the infection chain, and explain how this led to the ms-appinstaller HTML protocol handler being removed. We will finish by exploring network and file based detection opportunities for defenders.