Loading story…
Microsoft Defender Experts tracked a deceptive software-download campaign using counterfeit vendor websites and dynamically generated malicious installer archives to compromise victims. The activity primarily targeted China-based operations of multinational organizations and Chinese-speaking users in healthcare, manufacturing, gaming, technology, logistics, government, and education. Microsoft assessed with moderate confidence that the operation is consistent with the publicly reported Silver Fox (also known as Yinhu) threat activity, while stopping short of nation-state attribution.
The malware established persistence through scheduled tasks, abused msiexec and a repurposed TrueUpdate runtime, weakened Microsoft Defender and Windows Update protections, deleted shadow copies, injected into processes, and communicated with attacker infrastructure through non-standard ports and Alibaba Cloud OSS. Microsoft Defender detected and disrupted elements of the operation, including command-and-control traffic, attempted SMB lateral movement, and hands-on-keyboard activity; however, incident responders still needed to remove the attackers' persistence mechanisms.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
In April 2026, CylindricalCanine reportedly compromised a DigiCert support user's device and intercepted code-signing certificates intended for DigiCert customers. The group then used the intercepted certificates to sign Golden Gh0st Loader malware.
Microsoft reported that the Silver Fox-linked counterfeit-installer campaign establishes scheduled-task persistence, creates SYSTEM-level tasks and PowerShell exclusions to weaken Microsoft Defender, and may delete shadow copies and disable Windows Update. Microsoft also observed hands-on-keyboard activity and attempted SMB lateral movement, and published associated delivery, staging, C2, and payload indicators.
Microsoft Defender Experts tracked an active campaign using counterfeit software-download sites and dynamically generated malicious installer archives to compromise victims, primarily China-based multinational operations and Chinese-speaking users. Microsoft assessed with moderate confidence that the activity was consistent with the publicly reported Silver Fox (Yinhu) campaign and reported detecting and disrupting portions of the activity.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 70 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
9 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcethehackernews.com
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourcemalware.news
Open sourcemicrosoft.com
Open sourceotx.alienvault.com
Open sourceexpel.com
Open sourcelearn.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A malware campaign is using fake Microsoft Teams download pages promoted on **X** to lure corporate users into installing trojanized ZIP archives that deploy **ValleyRAT**. Researchers said the infection chain relies on an **NSIS** installer and **DLL sideloading** through Tencent’s legitimate `GameBox.exe`, then uses PowerShell to add Windows Defender exclusions, hide files, and establish persistence through unauthorized service creation and registry artifacts including `_CCGDAT`. Once executed, the loader decrypts staged payloads from `user.dat` in memory using **AES** and **XOR**, with additional evasion through API hashing and reflective loading. The final ValleyRAT payload captures keystrokes, clipboard contents, and active-window activity before exfiltrating data to command-and-control infrastructure at `103.215.77.17`; researchers said the campaign shows Chinese-language artifacts and behavioral overlaps that likely tie it to the **SilverFox APT** cluster.
Jun 30, 2026
The Chinese cybercrime group **Silver Fox** is using typosquatted domains that mimic trusted software brands, including **Surfshark VPN, Signal, Telegram, Zoom, and Autodesk**, to trick Chinese-speaking users into downloading ZIP archives containing trojanized installers. Researchers said the installers deploy a malicious Autodesk binary that loads shellcode, retrieves command-and-control details, and pulls the newly documented **AtlasCross RAT** into memory from `bifa668[.]com` over TCP port `9899`, marking a shift from the group’s earlier **Gh0st RAT**-based tools such as **ValleyRAT** and **Winos 4.0**. AtlasCross RAT includes defense-evasion and post-compromise features such as **AMSI** and **ETW** bypasses, **ChaCha20**-encrypted C2 traffic, embedded **PowerChell** execution, **DLL injection**, **RDP session hijacking**, **WeChat DLL injection**, and disruption of Chinese security products. Reporting from multiple security firms indicates Silver Fox is conducting both broad cybercrime activity and more targeted intrusions across Asia, with victims and targeting tied to **Taiwan, India, Japan, and Southeast Asia**, while reuse of a stolen code-signing certificate suggests an effort to make payloads appear legitimate and improve evasion for data theft and financial fraud operations.
Jun 29, 2026
Threat actors are using **software impersonation** and **SEO poisoning** to push victims toward fake download sites for trusted enterprise and IT tools, then delivering malware through trojanized installers. In one campaign, **Storm-2561** used spoofed VPN vendor pages for products such as **Pulse Secure, Fortinet, and Ivanti** to steal enterprise VPN credentials. The malicious packages were hosted on GitHub, signed with a certificate issued to **"Taiyuan Lihua Near Information Technology Co., Ltd."**, and designed to show an error before redirecting victims to the legitimate vendor site, reducing suspicion while exfiltrating credentials. A separate but closely related campaign used fake **FileZilla** download pages to distribute a **Remote Access Trojan** through multi-stage loaders and **DLL sideloading**. Attackers bundled legitimate FileZilla software with a malicious `version.dll`, or dropped the DLL during installation so the malware would execute while the expected application appeared to install normally. Both reports describe the same broader intrusion pattern: adversaries abusing trusted brands, realistic lookalike websites, and legitimate software packaging to compromise users who believe they are downloading authentic tools. A separate **Warlock** intrusion analysis describing web shells, lateral movement, tunneling, and ransomware activity is a different incident and does not match this malware-delivery story.
Jun 29, 2026