Loading story…
Trend Micro reported that the Purple Fox malware operation adopted a new arrival vector while upgrading the tools used in its intrusion chain. The campaign, previously known for spreading through exploit kits and vulnerable internet-facing services, was observed broadening initial access methods to improve delivery and persistence on compromised Windows systems.
Researchers said the threat also refined its malware arsenal, indicating continued development of components used for payload delivery, evasion, and post-compromise activity. The changes suggest Purple Fox remained an active and adaptable threat, with operators updating both infection techniques and malware capabilities to increase the scale and resilience of infections.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Trend Micro published research describing Purple Fox adopting a new infection vector and improving its malware toolkit. The reference does not provide earlier dated events, so this publication is the only distinct event that can be reliably extracted from the provided content.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
PurpleFox operators have continued to evolve a modular Windows malware platform that combines downloader, backdoor, and botnet capabilities with rootkit-based stealth and persistence. Researchers and CERT-UA linked the threat to campaigns using **trojanized MSI and software installers**, **PowerShell-based fileless chains**, **WPAD abuse**, and exploit-driven propagation, with infections observed from Indonesia and the Middle East to a large outbreak in Ukraine that affected at least 2,000 systems. The malware has also been seen spreading through known vulnerability exploitation and password brute-forcing, while operators rotated through extensive command-and-control infrastructure, including hundreds of intermediate control servers. Recent PurpleFox activity added a **FatalRAT-derived payload** and the **FoxSocket** .NET backdoor, which uses encrypted WebSocket communications for command and control and supports reconnaissance, file theft, process execution, and payload delivery. Trend Micro reported that staged installers disguised as Telegram, WhatsApp, Adobe, and Chrome fetched different second-stage payloads based on filename markers, while signed or revoked code-signing certificates were used to load malicious kernel drivers and disable security tooling such as file system mini-filter drivers. Across multiple campaigns, PurpleFox has exploited vulnerabilities including `CVE-2021-1732`, `CVE-2020-1054`, `CVE-2019-1367`, `CVE-2018-8120`, and `MS15-051`, underscoring its shift from exploit-kit delivery to a broader, adaptable intrusion and malware-distribution ecosystem.
Aug 15, 2026
The China-linked threat group **Silver Fox** ran a phishing campaign that impersonated tax authorities in India and Russia to infect organizations with **ValleyRAT** and a newly documented Python backdoor, **ABCDoor**. Researchers said the activity began with fake tax notices sent as PDF attachments that directed victims to download a malicious archive. That archive contained a modified Rust-based loader, **RustSL**, which used geofencing, environment checks, stealth features, and persistence mechanisms before deploying ValleyRAT and then ABCDoor. More than 1,600 malicious emails were observed between early January and early February 2026, with victims spanning the industrial, consulting, retail, and transportation sectors. Analysis tied ABCDoor to Silver Fox’s toolkit since at least late 2024, with confirmed operational use starting in early 2025. On infected Windows systems, the malware established persistence through the **Run** registry key and a scheduled task named **`AppClient`**, concealed files under **`C:\ProgramData\Tailscale`**, and abused **`pythonw.exe`** and **`ffmpeg.exe`** to blend in while enabling surveillance, remote interaction, module execution, command-and-control, and data exfiltration. Researchers also identified a new ValleyRAT plugin that acted as a loader for ABCDoor, showing the group is expanding a malware chain built for covert access and follow-on control.
Jun 29, 2026
Reporting describes several unrelated but contemporaneous malware operations targeting both Windows and Linux environments. In Taiwan, FortiGuard Labs observed targeted phishing using tax and e-invoice lures to deliver **Winos 4.0 (ValleyRat)** and plugins, with delivery chains including malicious `.LNK` files, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud-hosted infrastructure that reduces the effectiveness of static blocklists. Separately, Cato CTRL reported a new Windows loader, **Foxveil**, that stages and retrieves shellcode via trusted platforms (**Cloudflare Pages**, **Netlify**, and **Discord attachments**) and executes payloads using techniques including **Early Bird APC injection** (often into a fake `svchost.exe`) or self-injection, while persisting via Windows services or masqueraded binaries dropped into `SysWOW64`. Additional reporting covers distinct campaigns in other regions and platforms. A LATAM-focused intrusion chain uses fake bank receipt lures (double-extension such as `.pdf.js`) to deliver **XWorm v5.6**, employing oversized/obfuscated JavaScript, WMI-based process creation (`Win32_Process`) to launch hidden PowerShell, and abuse of a hardcoded **Cloudinary** URL for staging—capabilities consistent with credential theft and enabling follow-on ransomware. Trellix analysis described a separate **Monero** cryptomining operation distributed via pirated software installers that propagates through **USB/external drives** to reach even air-gapped systems, using multi-component “watchdog” self-healing behavior and aggressive defense-evasion. On Linux, LevelBlue detailed a new **SysUpdate** variant (packed `ELF64`) that performs host reconnaissance and uses strong C2 encryption; researchers built a **Unicorn Engine**-based emulation tool to reproduce key generation/encryption routines and decrypt captured C2 traffic for investigation and detection engineering.
Jun 29, 2026