Counterfeit installers turn routine software downloads into enterprise breaches
Microsoft warns of a multi-sector campaign using counterfeit download sites for Edge, Kaspersky and Razer to deliver trojanized installers with persistent implants.
Microsoft Defender Experts tracked a campaign breaching organizations in healthcare, manufacturing, gaming, technology, logistics, government, and education via spoofed vendor download pages, often using .com.cn and .hl.cn domains. Installers keep the same filename while their hash changes on every download, indicating server-side payload generation that defeats file-based detection. The chain abuses msiexec.exe and scheduled tasks for persistence, adds Defender exclusions, deletes shadow copies, and disables Windows Update, with some hands-on-keyboard activity. The activity is consistent with the publicly reported Silver Fox (Yinhu) campaign, though Microsoft has not attributed it to a nation-state actor.
- Spoofed download pages impersonate Edge, Kaspersky, Razer, Baidu Netdisk, draw.io, and Sejda
- Payloads regenerate per download with identical filenames but changing hashes
- SYSTEM-level scheduled tasks modify Defender settings and add antivirus exclusions
- msiexec.exe abuse hides execution inside a Microsoft-signed process
- Activity aligns with Silver Fox (Yinhu) campaign; no nation-state attribution made
- Tags
- counterfeit-installersdefense-evasionfake-download-sitesmsiexecpersistencesilver-foxtrojanized-softwareyinhu
- Threat actors
- Silver Fox
- Organizations
- Microsoft
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | draw.io | sers and security tools to utilities such as Baidu Netdisk, draw.io, and Sejda PDF, to trick users into downloading malicious i |
From the original article
3 min read at csoonline.com
Microsoft has warned that attackers are breaching enterprise systems via counterfeit download sites impersonating software including Microsoft Edge, Kaspersky and Razer, delivering trojanized installers for persistent access.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.