TL;DR
In a bizarre supply-chain twist, LG’s monitor driver package—pushed through Windows Update—is silently installing a McAfee ad application on users’ PCs as soon as the monitor is connected. Microsoft has confirmed it is investigating the incident after widespread complaints, raising new alarms about the trustworthiness of hardware drivers distributed via its own update infrastructure.
What Happened
Users who plug in certain LG monitors are discovering that Windows Update automatically downloads and installs a McAfee-branded advertising application without any visible prompt or consent screen. The app, detected as “McAfee Security Scan Plus” by antivirus engines, began appearing on systems between July 18 and July 22, 2026, and Microsoft acknowledged the issue on July 23.
Key Facts
- The unsolicited app is delivered through Windows Update as part of a driver-related package for LG UltraGear and LG Ergo series monitors manufactured after January 2026.
- Users first reported the phenomenon on Reddit and the Windows Feedback Hub on July 20, 2026, with over 1,200 complaints logged by July 22.
- The app does not perform any security functions; it is a “sponsored content” installer that displays McAfee ads and attempts to upsell a premium subscription.
- Microsoft’s official statement, posted on the Windows Health Dashboard on July 23, says the company is “working with LG to understand how this package was added to Windows Update and to prevent further unsolicited installations.”
- LG Electronics has not yet issued a public statement; internal sources told Ars Technica the company is “reviewing the certification process for its driver packages.”
- The installer uses Windows Driver Provisioning—a mechanism meant to silently install critical firmware or driver updates—to execute the app, bypassing standard end-user consent flows.
- Affected systems include Windows 11 23H2 and 24H2, as well as Windows 10 22H2; the app persists even after the monitor is disconnected.
Breaking It Down
The core of this controversy isn’t the McAfee adware itself—it’s the abuse of a privileged delivery channel. Windows Update has long been considered a “safe zone” for device drivers because of Microsoft’s driver signing requirements and the WHQL (Windows Hardware Quality Labs) certification process. That LG was able to slip a promotional application into a driver bundle indicates a breakdown in that certification pipeline. The app is not a driver; it is pure advertising, yet it was signed with a valid Microsoft cross-certificate and delivered as though it were essential hardware software.
Over 99% of the reported installations occurred without any user interaction—not even a notification in the Action Center—because the package was classified as a “critical driver update” with a “DoNotDisplay” flag in its INF file. That means the software executed silently in the background, making discovery purely accidental when users noticed unusual CPU or disk activity.
The broader implication is that Microsoft’s driver provenance model has a blind spot: the company verifies the digital signature and basic structure of a driver package, but it does not audit the content for commercial “junkware” as long as the package meets technical requirements. LG apparently exploited this by embedding a separate executable that triggers during driver installation. This is reminiscent of the Superfish adware scandal on Lenovo systems in 2015, but the delivery vector here is far more pernicious because it uses the operating system’s own update mechanism rather than preloaded OEM software.
Another troubling angle is the timing. The LG monitor driver package was submitted to the Windows Hardware Developer Center on June 10, 2026, and passed certification on June 12. That means it took over a month for the adware to be discovered—a period during which tens of thousands of users may have been silently exposed. Microsoft’s “verified by WHQL” stamp is now effectively misleading because it implies a level of trustworthiness that the package clearly did not merit. This incident will inevitably force Microsoft to revisit the scope of its driver certification audits, potentially adding a mandatory “no third-party advertisements” clause and a manual content review for any driver that includes executable components beyond the driver itself.
What Comes Next
Microsoft and LG are under pressure to act quickly, but the fix will require changes to both the driver submission process and the Windows Update client behavior. Here is what to watch in the coming weeks:
- Microsoft’s automated rollback and block: As early as July 25, Microsoft is expected to push a Windows Update metadata update that revokes the LG driver package and triggers a removal of the McAfee app on all affected systems. This is a reversible measure while a permanent fix is developed.
- LG’s revised driver package: LG must submit a clean driver package stripped of the adware. That package will require re-certification, which typically takes 7–14 business days, meaning a fully vetted driver may not arrive until mid-August 2026.
- Potential FTC or EU regulatory attention: Consumer advocacy groups are already calling for an investigation. Given that this installation occurred without consent and through a privileged system channel, it may violate the FTC’s prohibition on deceptive practices and the EU’s ePrivacy Directive regarding unsolicited software installations. Watch for formal complaints to be filed by August 1.
- Windows Update policy changes: Microsoft may announce a revamp of its driver submission guidelines, including an explicit ban on “promotional content” in driver packages and a stricter post-certification monitoring system. An internal review task force is reportedly being assembled, with findings expected in September 2026.
The Bigger Picture
This incident sits at the intersection of two troubling trends: Driver Bloat and Supply-Chain Trust Erosion in Hardware Ecosystems. The first trend—driver bloat—has seen printer, GPU, and monitor manufacturers increasingly bundle utilities, updaters, and now ads into what should be lean, functional drivers. The second trend—supply-chain trust erosion—is a direct consequence of the industry’s shift toward automatic updates. When every peripheral manufacturer can digitally sign arbitrarily complex code and have that code executed on millions of machines with a single click (or no click at all), the attack surface expands dramatically.
This is not a one-off incident; it builds on a pattern of similar abuses. In 2024, Realtek audio drivers were found to include telemetry that complained to a third-party analytics service. In early 2025, ASUS accidentally shipped a beta kernel driver through Windows Update that caused blue screens. Each time, the response has been reactive, leaving the underlying mechanism—the ability to mix critical firmware with non-critical applications—unchecked. LG’s McAfee ad installation is a wake-up call that Microsoft’s “trust but verify” model for hardware drivers is no longer sufficient. The company may need to move toward a “provenance manifest” for every driver package that lists all executable files, their purposes, and their network permissions, with a mandatory user approval prompt for any component that is not strictly a driver.
Key Takeaways
- [Silent Installation]: The McAfee ad app was installed via Windows Update without any user notification, exploiting a driver provisioning flag that bypasses consent.
- [WHQL Certification Gap]: Microsoft’s driver certification process did not inspect the package for advertising content, highlighting a critical oversight in the verification workflow.
- [Immediate Remediation Expected]: Microsoft is likely to revoke the LG driver package within days, but a fully clean replacement driver may not be available until mid-August.
- [Systemic Trust Issue]: The incident underscores the vulnerability of automatic driver updates to being co-opted for malware-like ad delivery, potentially inviting regulatory scrutiny and platform policy reforms.
