the offending KB's
The big culprit is KB 3035583. it shows the usual blurb about "solving problems in windows" in the update info, but actually installs an app called "dowload windows 10 for win 7SP1 and Win 8.1".
Associated to it are KB's 2999226 ( update for win10 universal CRT ) and 2952664 ( upgrade to win7 to "facilitate" the upgrade to the latest version of windows.. a whole slew of files gets adressed here.). Both the same noninformative blurb, and you need to actually *read* the KB info to figure out what's up.
I think there's legal terms for this kind of behaviour. Not very nice ones either.