A supply chain compromise of Korean-language Windows 11 installation media created with Microsoft's official Media Creation Tool distributed infostealer malware through a scheduled task that activated in July 2025 after nine months dormant. The tampering affected only Korean-language media on physical machines, not English versions or virtual environments, and was later linked to the JSCEAL campaign targeting cryptocurrency users.