An ongoing malware operation is using counterfeit software-download websites to mimic legitimate vendors and spread harmful installers, according to a new disclosure from Microsoft. The campaign has compromised users seeking to download well-known software, resulting in breaches across numerous organizations and industries, mainly affecting China-based divisions of multinational companies and individuals who speak Chinese. Once executed, the installers deliver malware capable of establishing persistence, undermining security safeguards, and connecting with infrastructure controlled by attackers.

The operation has impacted victims in healthcare, manufacturing, gaming, technology, logistics, government, and education sectors. Microsoft has determined with moderate confidence that the campaign aligns with a Chinese threat cluster called Silver Fox, also known as Yinhu, which has previously used fake vendor download pages to spread Gh0st RAT and ValleyRAT. The fraudulent websites are hosted on .com.cn and .hl.cn infrastructure and feature Chinese-language content designed to prompt downloads of ZIP archives from "gehie246[.]com." The counterfeit sites include app-microsoft-edge[.]com[.]cn, baidu-pan[.]com[.]cn, calibre-ebook[.]com[.]cn, kaspersky-lab[.]hl[.]cn, and sejda[.]hl[.]cn, among others. The web pages are precise replicas of the authentic vendor's site and include a clear download button. The archive maintains the same file name while its hash shifts with each download, suggesting the payload is created server-side dynamically for every request. Opening the archive triggers a wrapper installer that launches the first stage payload, while a second execution method uses the trusted Windows Installer service to launch a randomized executable.

"The campaign has targeted users looking to download popular software and has resulted in compromises across multiple organizations and industries," Microsoft stated. The malware achieves persistence through scheduled tasks that resemble routine IT or productivity jobs, and it creates a temporary scheduled task running as SYSTEM that configures Microsoft Defender exclusions via PowerShell, erases volume shadow copies, and modifies discretionary access control lists using icacls to prevent standard users from removing payload directories. The malware also interferes with Windows Update by stopping and disabling key services, renaming update DLLs, and deleting the SoftwareDistribution cache. After completing these actions, the malware sets up command-and-control communication over application-layer protocols on non-standard ports including 5090, 7031, 7032, 7088–7090, 8050, 28290, and 28300, with two C2 domains identified as "iualef[.]net" and "oijfwe[.]net."

The campaign's ultimate objective remains unknown, as Microsoft reported that Defender detected the threat and initiated automated containment procedures through attack disruption to reduce the attack's impact further. The disclosure follows closely after Kaspersky detailed a malicious installer that deploys a modified Chinese desktop wallpaper management tool called QN Wallpaper while using it to start a DLL sideloading chain that delivers ValleyRAT. The backdoor captures keystrokes and clipboard contents, saves the data to disk, and periodically scans for active windows belonging to applications that could analyze processes or traffic. ValleyRAT is a sophisticated implant with extensive features that enable it to gather system information, reboot or shut down the computer, capture screenshots, clear logs, update C2 addresses, download additional DLL or shellcode modules, and transmit keylogger logs along with clipboard data. According to a report published by Expel last month, ValleyRAT has also been linked to a sub-group within GoldenEyeDog known as CuboidalCanine, which is believed to have shifted away from Gh0st RAT at some point and targets the gambling industry using watering holes to distribute the malware by abusing code-signing certificates to bypass security controls. In June 2026, Chinese authorities took action against a series of cybercrime cases distributing a new variant of the Silver Fox trojan, state media outlet China Daily reported. Organizations face mounting pressure to verify software sources and harden endpoint defenses as threat actors continue refining social engineering tactics that exploit trust in familiar brands. The persistence mechanisms and security-disabling techniques employed in this campaign demonstrate how attackers prioritize maintaining access once initial compromise succeeds.