SilverFox Hackers Built Fake Software Sites That Hide Malware From Security Researchers
Microsoft ties Silver Fox fake download sites to Windows malware mainly hitting Chinese-speaking users.
Microsoft assesses with moderate confidence that counterfeit software download sites serving malicious Windows installers are consistent with Silver Fox, also called Yinhu, and does not attribute the activity to a nation-state. Observed compromises span several industries and mainly affect Chinese-speaking users; archives can change between requests while later stages create scheduled tasks, alter exclusions, disable Windows Update, remove recovery copies, and contact attacker infrastructure. Separately, Pelagos Intel examined a finance-themed WhatsApp attachment sent to a Malaysian recipient that paired a signed Guangzhou Kugou launcher with an unsigned DLL, set a Run-key startup entry, and made repeated connections to 134.122.155.135:443. The two chains are not shown to share infrastructure.