SilverFox Hackers Built Fake Software Sites That Hide Malware From Security Researchers

Fake software download pages are drawing Windows users into a Silver Fox-linked malware campaign. The pages imitate familiar vendors and supply installers that can leave an infected computer vulnerable to continued access.

Microsoft has observed compromises across several industries, mainly affecting Chinese-speaking users.

The attackers rely on a simple habit: people search for an application, recognize its branding, and click download. Other Silver Fox-related activity has used messages and attachments.

Researchers at Pelagos Intel identified one such separate chain involving a finance-themed WhatsApp message aimed at a Malaysian recipient.

The attachment carried a signed program and an unsigned library. That finding does not establish that the WhatsApp operation used the counterfeit websites.

Microsoft assesses the fake-installer campaign as consistent with Silver Fox, also called Yinhu, with moderate confidence. It has not attributed the operation to a nation-state actor.

Pelagos Intel said in a report shared with Cyber Security News (CSN) that its separately analyzed files established persistence and repeatedly attempted to reach an external server.

SilverFox Hackers Built Fake Software Sites

The cloned pages copy the look of legitimate software download sites, including pages for browsers, security tools, and everyday utilities.

Microsoft traced visitors from a counterfeit page to a download host serving a ZIP archive. Its Silver Fox fake installer investigation describes how familiar branding can hide a dangerous installation chain.

Two archives with the same name arrived roughly 69 seconds apart, yet contained different material. Microsoft says the archive can be rebuilt for each request while its name and download address stay the same.

That makes a single archive hash a poor way to recognize every copy, but it is not evidence that the websites identify and selectively deceive security researchers.

Once opened, the archive launches a wrapper that places malicious code in a randomly named Windows folder. Another observed route runs through Windows Installer, a system component.

A user expecting a routine installation may therefore miss the extra program starting in the background, especially when the visible download page looks convincing.

This approach has precedent: a fake security software download was previously linked to a Silver Fox-related infection. These were separate operations.

They do, however, show why recognizable branding and apparently ordinary installers deserve closer scrutiny when the download source cannot be verified.

Persistence And Detection Clues

Microsoft found that later stages created scheduled tasks to restart malicious programs and briefly ran a task with high system privileges to change security exclusions.

The malware also tried to disable Windows Update, remove recovery copies, and contact attacker-controlled infrastructure. Such changes can make both discovery and cleanup harder after the original installer has closed.

Pelagos Intel’s WhatsApp case followed a different technical route. A validly signed launcher called functions in an unsigned library that presented itself as a Windows desktop component.

The library decoded data and copied transformed content into executable memory. The same files were then copied into a user profile, with a startup registry entry set to run them again.

During testing, Pelagos recorded 96 connection attempts about three seconds apart. It also observed a successful decryption operation whose length matched a transformation identified during code analysis.

These observations support a configured, persistent loader, but the report does not demonstrate that this chain and Microsoft’s fake-site campaign are the same intrusion.

Earlier reporting on trusted software loading malware illustrates why a valid signature on one file cannot clear every neighboring component.

Likewise, tax themed Silver Fox lures show that an apparently credible document or message can be the first step toward a separate infection. These links provide context, not proof of shared infrastructure. This distinction matters when teams compare samples and reports.

For the counterfeit-site campaign, Microsoft recommends downloading from verified sources, watching for unexpected archive downloads, and alerting on suspicious scheduled tasks or security-setting changes.

For the WhatsApp chain, Pelagos highlights the unusual startup entry, staged file pair, and regular outbound attempts as useful investigation leads. Teams should verify which chain they are investigating before applying the indicators below.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post SilverFox Hackers Built Fake Software Sites That Hide Malware From Security Researchers appeared first on Cyber Security News.