An ongoing malware campaign is leveraging bogus software-download websites to mimic trusted vendors and deploy malicious installers, as detailed by **Microsoft**. "The campaign has targeted users looking to download popular software and has resulted in compromises across multiple organizations and industries, primarily affecting China-based operations of multinational organizations and Chinese-speaking users," **Microsoft** reported. Upon execution, these installers deploy malware capable of establishing persistence, weakening security protections, and communicating with attacker-controlled infrastructure. Victims span healthcare, manufacturing, gaming, technology, logistics, government, and education sectors. **Microsoft** has assessed with moderate confidence that the campaign aligns with **Silver Fox** (aka Yinhu), a Chinese threat cluster known for using spoofed vendor download pages to distribute **Gh0st RAT** and **ValleyRAT** (aka **WinOS 4.0**). ### Deceptive Tactics and Infrastructure The observed websites are hosted on .com.cn and .hl.cn infrastructure, employing Chinese-language lure content to prompt the download of a ZIP archive from "gehie246[.]com." Examples of these counterfeit domains include: * app-microsoft-edge[.]com[.]cn * baidu-pan[.]com[.]cn * calibre-ebook[.]com[.]cn * cn-drawio[.]com[.]cn * gw-sogou[.]com[.]cn * kaspersky-lab[.]hl[.]cn * mindmoster[.]com[.]cn * ocam-pc[.]com[.]cn * pc-razerzone[.]com[.]cn * sejda[.]hl[.]cn * steelseries-cn[.]com[.]cn * translate-youdao[.]hl[.]cn * zh-diskgenius[.]com[.]cn These web pages are high-fidelity clones of legitimate vendor sites, featuring prominent download calls-to-action. Notably, the downloaded archive maintains the same file name, but its hash changes with every download, indicating server-side payload generation for each request. Opening the archive initiates a wrapper installer (e.g., "a_instapp83353001.exe" or "ainst8663586104.exe"), which launches the first-stage payload. **Microsoft** also observed a second execution vector utilizing the trusted **Windows Installer** service ("msiexec.exe") to launch a randomized executable, mirroring the masquerade pattern.  ### Persistence and Evasion Techniques Persistence is achieved via scheduled tasks designed to imitate routine IT or productivity jobs. The malware also creates a short-lived scheduled task that runs as **SYSTEM** and configures **Microsoft Defender** exclusions through **PowerShell**. It deletes volume shadow copies and modifies discretionary access control lists (DACLs) using `icacls` to prevent standard users from removing payload directories. Furthermore, the malware tampers with **Windows Update** by stopping and disabling `wuauserv`, `UsoSvc`, `uhssvc`, and `WaaSMedicSvc`. It also renames update dynamic-link libraries (DLLs) and deletes the `SoftwareDistribution` cache. Once these steps are completed, the malware establishes command-and-control (C2) over application-layer protocols on non-standard ports such as 5090, 7031, 7032, 7088–7090, 8050, 28290, and 28300. Two C2 domains associated with this activity are "iualef[.]net" and "oijfwe[.]net." The ultimate goal of the campaign remains unclear, as **Microsoft Defender** detected the activity and initiated automated containment procedures through **attack disruption** to limit the attack's impact.  ### ValleyRAT's Expanded Reach This disclosure follows **Kaspersky's** recent report detailing a malicious installer that deploys a modified Chinese desktop wallpaper management tool, **QN Wallpaper**. This tool is then used to initiate a DLL sideloading chain delivering **ValleyRAT**. "The original version of **QN Wallpaper** is genuine adware: on installation, it delivers bundled partner apps to the device and then displays ad banners to the user," **Kaspersky** explained. "In this case, however, the attackers use it to carry out DLL sideloading, a technique that allows malicious code to run under the guise of a signed process by way of a malicious DLL." **ValleyRAT** is a sophisticated implant capable of collecting system information, rebooting/shutting down computers, taking screenshots, wiping logs, updating C2 addresses, downloading additional DLL or shellcode modules, and sending keylogger logs and clipboard data. It also actively scans for active windows belonging to applications that could be used for process or traffic analysis. **Kaspersky** noted, "The attackers exploited a well-known adware application to run the backdoor under the guise of a signed process, which complicates detection. Motivated by both cyber espionage and financial gain, **Silver Fox** targets organizations across multiple countries." Last month, **Expel** published a report attributing **ValleyRAT's** use to **CuboidalCanine**, a sub-group within **GoldenEyeDog**. This sub-group, which targets the gambling industry, has reportedly moved away from **Gh0st RAT** and uses watering holes to distribute malware by abusing code-signing certificates to bypass security controls. Security researcher **Aaron Walton** commented, "This malware isn't unique to any actor... Due to the source code being public, attribution of this malware to any actor relies on factors other than the malware family itself." Chinese authorities took action against several cybercrime cases distributing a new variant of the **Silver Fox** trojan in June 2026, as reported by state media outlet **China Daily**.