CTI · reviewed · 2026-09-29

SilverFox Malware Campaign Uses Smart Filtering to Hide Fake Software Downloads From Researchers

Full story & timeline

MITRE ATT&CK

• T1194 Spearphishing via Service Initial Access
• T1073 DLL Side-Loading Stealth
• T1116 Code Signing Stealth
• T1036 Masquerading Stealth

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: SilverFox Side-Load DLL Dropping With Microsoft DWM Masquerade
id: 12314e5e-26f8-4696-8452-c7ab68bd7fae
status: experimental
description: >
    Detects creation of active_desktop_render_x64.dll, the unsigned
    side-loading DLL planted next to a signed KuGou launcher executable in
    the SilverFox-linked WhatsApp delivery chain analysed by Pelagosx
    (2026): the DLL carries metadata resembling a Microsoft Desktop Window
    Manager component and exposes SetDesktopMonitorHook and
    ClearDesktopMonitorHook exports that run the obfuscated payload.
references:
    - https://gbhackers.com/silverfox-built-fake-software/
    - https://cyberpress.org/silverfox-hides-fake-downloads/
author: Tia N. List
date: 2026/09/29
tags:
    - attack.t1073
    - attack.t1036
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|endswith: '\active_desktop_render_x64.dll'
    condition: selection
falsepositives:
    - Unknown third-party software using the same filename; verify the
      signing status and loaded parent process before acting
level: high

References

• https://cyberpress.org/silverfox-hides-fake-downloads/
• https://gbhackers.com/silverfox-built-fake-software/