SilverFox Hackers Built Fake Software Sites That Hide Malware From Security Researchers
Microsoft ties Silver Fox fake download sites to Windows malware mainly hitting Chinese-speaking users.
9
Stories per day · 30 days
2 RSS
11 stories, newest first · one card per story
Stories tagged #silver-fox
SilverFox Built Fake Software Sites That Know When Researchers Are Watching
Silver Fox operators delivered a Windows loader via WhatsApp while hiding payloads from security researchers.
4
PAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacks
PAPERMILL phishing campaign abuses a signed Notepad++ copy and tax-audit lures to deploy VenomRAT against targets in India.
1
PAPERMILL Malware Campaign Abuses Signed Notepad++ to Deliver VenomRAT to Windows Users
JUMPSEC tracks PAPERMILL, a China-nexus phishing campaign using a signed Notepad++ binary, libcurl.dll sideloading, and Donut loaders to deploy VenomRAT against Indian tax-audit targets.
2
Counterfeit installers turn routine software downloads into enterprise breaches
Microsoft warns of a multi-sector campaign using counterfeit download sites for Edge, Kaspersky and Razer to deliver trojanized installers with persistent implants.
4
Fake Software Installers Disable Windows Update and Weaken Microsoft Defender
Fake software-download sites distribute installers that disable Windows Update and weaken Defender, attributed to China-linked cluster Silver Fox.
7
Counterfeit installers to system compromise: Tracking a deceptive software download campaign
Microsoft tracks a counterfeit software-installer campaign compromising multinationals' China operations, moderately linked to the Silver Fox (Yinhu) actor.
13
ValleyRAT: When Legitimate Software Becomes a Malware Delivery Tool
Kaspersky details ValleyRAT delivered via trojanized QN Wallpaper using DLL sideloading, tied to Silver Fox and hitting 1,500+ users in China and India.
ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions
Silver Fox distributes ValleyRAT via signed QN Wallpaper adware, sideloading a malicious libcef.dll into a trusted process to evade defenses.
Spark RAT Targets Cambodia, Abuses Vulnerable OPSWAT Driver to Disable Security Tools
Acronis details a Spark RAT campaign against Cambodia abusing the vulnerable OPSWAT ardrv.sys driver (CVE-2026-36425) to disable Microsoft Defender and other security tools.
1
Silver Fox Targets Japanese Manufacturer with 3
Chinese group Silver Fox used new vulnerable drivers and DLL side-loading to deploy ValleyRAT at a Japanese industrial manufacturer.