SilverFox Hackers Built Fake Software Sites That Hide Malware From Security Researchers
Microsoft ties Silver Fox fake download sites to Windows malware mainly hitting Chinese-speaking users.
72
Threat actor
Silver Fox
- Mentions · 7d0
- Mentions · 30d0
- All mentions12
- First seenAug 18, 2026
- Last mentionedSep 29, 2026
Timeline
12 articles · newest firstSilverFox Built Fake Software Sites That Know When Researchers Are Watching
Silver Fox operators delivered a Windows loader via WhatsApp while hiding payloads from security researchers.
61
PAPERMILL Malware Campaign Abuses Signed Notepad++ to Deliver VenomRAT to Windows Users
JUMPSEC tracks PAPERMILL, a China-nexus phishing campaign using a signed Notepad++ binary, libcurl.dll sideloading, and Donut loaders to deploy VenomRAT against Indian tax-audit targets.
55
HVNC Backdoor Targets LATAM Organizations with Fake Tax and DocuSign Lures
A custom HVNC backdoor is targeting Latin American financial organizations via fake DocuSign and NFe tax-document lures, giving attackers hidden persistent remote access.
55
Counterfeit installers turn routine software downloads into enterprise breaches
Microsoft warns of a multi-sector campaign using counterfeit download sites for Edge, Kaspersky and Razer to deliver trojanized installers with persistent implants.
65
Fake Software Installers Disable Windows Update and Weaken Microsoft Defender
Fake software-download sites distribute installers that disable Windows Update and weaken Defender, attributed to China-linked cluster Silver Fox.
68
Counterfeit installers to system compromise: Tracking a deceptive software download campaign
Microsoft tracks a counterfeit software-installer campaign compromising multinationals' China operations, moderately linked to the Silver Fox (Yinhu) actor.
63
ValleyRAT: When Legitimate Software Becomes a Malware Delivery Tool
Kaspersky details ValleyRAT delivered via trojanized QN Wallpaper using DLL sideloading, tied to Silver Fox and hitting 1,500+ users in China and India.
55
ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions
Silver Fox distributes ValleyRAT via signed QN Wallpaper adware, sideloading a malicious libcef.dll into a trusted process to evade defenses.
62
Spark RAT Targets Cambodia, Abuses Vulnerable OPSWAT Driver to Disable Security Tools
Acronis details a Spark RAT campaign against Cambodia abusing the vulnerable OPSWAT ardrv.sys driver (CVE-2026-36425) to disable Microsoft Defender and other security tools.
50
Silver Fox Targets Japanese Manufacturer with 3
Chinese group Silver Fox used new vulnerable drivers and DLL side-loading to deploy ValleyRAT at a Japanese industrial manufacturer.
58
New Chaos Variant Targets Misconfigured Cloud Deployments, Adds SOCKS Proxy
Darktrace says the Chaos botnet now targets misconfigured cloud deployments like Hadoop and added a SOCKS proxy for traffic relaying.
40
Related CVEs
by mentions- CVE-2026-36425<1%6.5An issue in OPSWAT AppRemover Driver (ardrv.sys) v2017.10.02.1551 and earlier in IOCTL handler 0x2420031
Appears with
- ValleyRATmalware · 6
- Kasperskyvendor · 5
- Microsoftvendor · 4
- Yinhuthreat actor · 3
- Microsoftorganization · 3
- Razervendor · 2
- Guangzhou Kugou Technologyorganization · 2
- Microsoft Edgeproduct · 2
- Windowsproduct · 2
- QN Wallpaperproduct · 2
- Cato Networksvendor · 2
- Microsoft Defenderproduct · 2
- WhatsAppproduct · 2
- ValleyRATproduct · 1
- Alibaba Cloudvendor · 1
- Baidu Netdiskproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.