Fake Software Download Sites Used to Spread Silver Fox Malware

Cybercriminals are using fake software download websites to impersonate trusted vendors and distribute malicious Windows installers. The campaign has affected organizations across healthcare, manufacturing, gaming, technology, logistics, government, and education.

Microsoft said the activity primarily targets China based operations of multinational organizations and Chinese speaking users. The company assesses with moderate confidence that the campaign is linked to the Chinese threat cluster known as Silver Fox, also called Yinhu.

Fake Websites Impersonate Trusted Software Vendors

The attackers create high quality copies of legitimate software websites and use Chinese language content to convince users to download software.

The fake sites observed in the campaign use .com.cn and .hl.cn domains and redirect victims to ZIP archives hosted on attacker controlled infrastructure.

Examples of impersonated software include:

  • Microsoft Edge
  • Baidu Pan
  • Calibre
  • Draw.io
  • Sogou
  • Kaspersky
  • MindMaster
  • oCam
  • Razer
  • Sejda
  • SteelSeries
  • Youdao Translate
  • DiskGenius

The downloaded archive keeps the same filename, but its hash changes with every download. This indicates that the malicious payload may be generated dynamically on the server for each request.

Malicious Installers Launch the First Stage

Opening the ZIP archive leads to a malicious wrapper installer with randomized filenames such as a_instapp83353001.exe and ainst8663586104.exe.

Microsoft also observed another infection method involving the legitimate Windows Installer service, msiexec.exe, which launches a randomized executable while maintaining the same software masquerading technique.

After execution, the malware establishes persistence and begins weakening security protections on the compromised system.

Malware Disables Security Protections

The malware creates scheduled tasks designed to look like normal IT or productivity jobs.

It also creates a temporary scheduled task that runs with SYSTEM privileges and performs several malicious actions, including:

  • Adding Microsoft Defender exclusions through PowerShell
  • Deleting Volume Shadow Copies
  • Changing file and folder permissions using icacls
  • Preventing standard users from removing malicious payload directories
  • Stopping and disabling Windows Update related services
  • Renaming Windows Update DLL files
  • Deleting the Windows SoftwareDistribution cache

These actions can make detection, recovery, and remediation more difficult.

Command and Control Communication

After establishing persistence, the malware connects to attacker controlled command and control infrastructure using application layer protocols over non standard ports.

Microsoft identified activity involving ports including:

  • 5090
  • 7031
  • 7032
  • 7088 to 7090
  • 8050
  • 28290
  • 28300

Two C2 domains associated with the campaign are iualef[.]net and oijfwe[.]net.

Microsoft said the ultimate objective of the campaign remains unclear. Microsoft Defender detected the activity and used automated attack disruption and containment measures to limit its impact.

ValleyRAT Also Linked to Silver Fox Activity

The campaign comes shortly after Kaspersky reported another Silver Fox related attack involving a modified version of the Chinese QN Wallpaper application.

The attackers used the application to perform DLL sideloading, allowing malicious code to execute under the appearance of a legitimate signed process.

The modified application was used to deliver ValleyRAT, a backdoor capable of collecting system information and performing multiple surveillance and control activities.

ValleyRAT can:

  • Capture keystrokes
  • Collect clipboard contents
  • Take screenshots
  • Reboot or shut down systems
  • Delete logs
  • Update C2 addresses
  • Download additional DLLs and shellcode
  • Send stolen keylogging and clipboard data to attackers
  • Monitor applications that may be used to analyze processes or network traffic

Attribution Remains Complex

ValleyRAT has been associated with multiple Chinese threat groups, including Silver Fox and a GoldenEyeDog subgroup known as CuboidalCanine.

Expel previously reported that CuboidalCanine had shifted away from Gh0st RAT and was targeting the gambling sector using watering hole attacks and code signing certificates to bypass security controls.

Security researchers have also warned that ValleyRAT cannot be attributed to a single actor based only on the malware itself because its source code is publicly available.

Chinese authorities also took action in June 2026 against several cybercrime cases involving a newer variant of the Silver Fox trojan.

Key Takeaway

The campaign highlights the risks of downloading software from search results or unofficial websites. Attackers are using highly convincing vendor clones and dynamically generated installers to make malicious software appear legitimate.

Organizations should encourage users to download software only from verified vendor websites, monitor unusual scheduled tasks and security configuration changes, and investigate unexpected Windows Update or Microsoft Defender modifications.

SEO Meta Description:

Cybercriminals are using fake software download websites to spread Silver Fox malware, disable Windows security protections, establish persistence, and connect to attacker controlled C2 servers.