# SilverFox (Yinhu) Fake Software Download Sites Deliver Per-Request Malware Installers and Weaken Windows Defenses

> Microsoft Defender Experts assess with moderate confidence that a campaign using cloned vendor download sites (browsers, security tools, utilities) is consistent with Silver Fox (aka Yinhu). Sites serve server-side regenerated ZIP installers that drop randomly named payloads, create SYSTEM scheduled tasks, add Defender exclusions, disable Windows Update and delete shadow copies, mainly hitting Chinese-speaking users across several industries.

- **Published:** 2026-09-29T00:00:00Z
- **Last reviewed:** 2026-09-29T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2773
- **ID:** TL-2026-2773
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Void Arachne
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Microsoft Defender Experts (blog dated 2026-09-01) track an active campaign in which counterfeit software-download websites impersonate trusted vendors including Razer, Microsoft Edge, Kaspersky, Sejda PDF, NetEase Youdao, DiskGenius, Baidu Netdisk, oCam, draw.io, SteelSeries, Sogou, Calibre and MindMaster. Lookalike domains sit under .com.cn and .hl.cn. Microsoft assesses with moderate confidence that the activity is consistent with the publicly reported Silver Fox (Yinhu, 银狐) fake-software campaign and has not attributed it to a nation-state. Victims span healthcare and medical devices, manufacturing, gaming, technology, logistics, government and higher education, primarily China-based operations of multinationals and Chinese-speaking users.

The archive keeps the same file name (rotating patterns such as app_setup.*, zinst.*, zintall.*, intsoft.*, innstll.*) but its hash changes on every download, meaning the payload is generated server-side per request. Two archives with identical names were observed arriving about 69 seconds apart with different contents. Single-hash blocking of the archive is therefore ineffective; Microsoft recommends pivoting on the stable payload hashes, drop-path patterns and post-execution behavior instead. This per-request rebuilding is what hampers researchers and signature-based detection.

Extracting the archive launches a wrapper installer (e.g. a_instapp83353001.exe, ainst8663586104.exe) that places a randomized stage-one payload in a world-writable location such as C:\Users\Public\<random>\<random>.exe or C:\Program Files (x86)\<random>\<random>.exe. An alternate route runs the payload through msiexec.exe -Embedding to hide behind Windows Installer. Payloads masquerade as legitimate software (Philips Speech Driver, Indigo Rose TrueUpdate Client) with placeholder version metadata, sideload malicious DLLs (UxEnhance64.dll in stage one, XPSPLOG.dll in later stages), and inject into legitimate user applications through remote-thread creation. Persistence is via scheduled tasks with benign-sounding names (e.g. 'Deadline Mission Target', 'Hierarchy Tools Smooth Inventory') that relaunch payloads from C:\ProgramData\ roughly every 60 seconds; icacls is used to grant Administrators/SYSTEM full control over payload files.

Before hands-on activity the payloads weaken the host: SYSTEM scheduled tasks write Microsoft Defender exclusions (Add-MpPreference -ExclusionPath for C:\ProgramData, C:\Users, C:\Program Files (x86) and C:\), 'vssadmin delete shadows /all /quiet' removes recovery copies, and wuauserv, UsoSvc, uhssvc and WaaSMedicSvc are stopped and disabled, wuaueng.dll is renamed, and the NoAutoUpdate policy is set. C2 traffic uses non-standard ports (5090, 7031, 7032, 7088-7090, 8050, 28290, 28300) to a set of IPs and six-character .net domains, and follow-on payloads are pulled from Alibaba Cloud OSS buckets. Third-party reporting of this campaign (CraftedSignal, summarizing Microsoft) names ValleyRAT (WinOS 4.0) and Gh0st RAT as payloads; the Microsoft text reviewed here did not itself name a final RAT.

A separate, distinct chain documented by Pelagos Intel (report 2026-09-27) reached a Malaysian recipient via WhatsApp: a finance-themed message carried PDF_C2841_20260911100446.zip containing an IMG with a signed launcher (PDF_C2089_20260911100446.exe, KuGou signer metadata) and an unsigned DLL (active_desktop_render_x64.dll posing as dwmapi.dll). The DLL runs an XOR routine, resolves APIs by hash, copies an 11,200-byte buffer to executable memory, stages files under %APPDATA%\Microsoft\Update\, persists through HKCU Run value 'MicrosoftUpdate', and repeatedly beacons to 134.122.155.135:443 (96+ attempts about 3 seconds apart). Pelagos ties this only at ecosystem level to Silver Fox tradecraft, not to the fake-site campaign, so the two sets of indicators should be applied separately.

## MITRE ATT&CK

- T1583.001 Domains
- T1583.006 Web Services
- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1053.005 Scheduled Task
- T1547.001 Registry Run Keys / Startup Folder
- T1218.007 Msiexec
- T1574.001 DLL
- T1055 Process Injection
- T1036.005 Match Legitimate Resource Name or Location
- T1685 Disable or Modify Tools
- T1222.001 Windows Permissions
- T1112 Modify Registry
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1071 Application Layer Protocol
- T1571 Non-Standard Port

## Sources

- [Microsoft Security Blog: Counterfeit installers, system compromise: tracking a deceptive software download campaign](https://www.microsoft.com/en-us/security/blog/2026/09/01/counterfeit-installers-system-compromise-tracking-deceptive-software-download-campaign/)
- [Pelagos Intel: SilverFox in the Desktop](https://research.pelagos-intel.com/silverfox-in-the-desktop)
- [The Hacker News: Fake Software Installers Disable Windows Update and Defender](https://thehackernews.com/2026/09/fake-software-installers-disable.html)
- [SilverFox Hackers Built Fake Software Sites That Hide Malware From Security Researchers](https://cybersecuritynews.com/silverfox-hackers/)
- [CraftedSignal: Silver Fox fake installers brief](https://feed.craftedsignal.io/briefs/2026-09-silver-fox-fake-installers/)
- [TechRadar: Malware installer posing as a legitimate download service infecting brands across almost every industry](https://techradar.com/pro/security/a-malware-installer-posing-as-a-legitimate-download-service-is-infecting-brands-across-almost-every-industry-microsoft-edge-razer-kaspersky-and-more-actively-imitated)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2773