Reported by 3 outlets

Timeline

1. original reporting

   Counterfeit installers to system compromise: Tracking a deceptive software download campaign

   microsoft.com · 42d ago · September 1st, 2026

   In this article Attack chain overview Campaign scope and targeting Mitigation and protection guidance References Learn more Microsoft Defender Experts is tracking an active malware campaign that uses counterfeit software-download websites to impersonate trusted vendors and distribute malicious installers. The campaign has targeted users looking to download popular software and has resulted in compromises across multiple organizations and industries, primarily affecting China-based operations of multinational organizations and Chinese-speaking users. Microsoft has observed victims across healthcare, manufacturing, gaming, technology, logistics, government, and education sectors. Once executed, the malicious installers deploy malware that establishes persistence, attempts to weaken security protections, and communicates with attacker-controlled infrastructure. Microsoft assesses with moderate confidence that this activity is consistent with the publicly reported Silver Fox (also known as Yinhu, 银狐) fake software campaign but has not attributed it to a nation-state actor. Microsoft Defender detected and disrupted activity across multiple stages of the attack, including automated containment through attack disruption. Organizations should prioritize preventing downloads from untrusted software sources and ensure protections such as SmartScreen, network protection, tamper protection, and Microsoft Defender XDR are enabled to help identify, block, and respond to related activity. A

2. update from cyberpress.org

   Silver Fox Hackers Target China-Based Organizations With Counterfeit Software Installers

   cyberpress.org · 41d ago · September 2nd, 2026

   Attackers lure victims with convincing copies of legitimate software vendor websites, offering downloads for popular tools, drivers, browsers, security products, and utilities. The attackers use look-alike domains that imitate brands including Razer, Microsoft Edge , Kaspersky, Calibre, SteelSeries, Baidu Netdisk, Sogou, and draw.io. For example, the campaign used pc-razerzone[.]com[.]cn and app-microsoft-edge[.]com[.]cn to host fraudulent download pages. These pages contain a prominent “Download now” button that redirects users to malicious ZIP archives hosted on separate delivery infrastructure. , zinst. , zintall. , intsoft. , and innstll.* were dynamically generated for each download. Silver Fox Targets China This technique allows the attackers to retain the same archive name while changing the file hash and internal contents. As a result, simple hash-based detection may be less effective. After a victim extracts and runs the installer, a wrapper executable creates a malware payload in randomized folders under locations such as C:\Users\Public\ , C:\ProgramData\ , or C:\Program Files (x86)\ . The malware also uses randomized filenames to make identification harder. Diagram showing the campaign attack chain from spoofed download page to archive delivery, execution, persistence, defense evasion, and

3. update from gbhackers.com

   Fake Microsoft Edge, Kaspersky and Razer Installers Used to Compromise Windows Systems

   gbhackers.com · 41d ago · September 2nd, 2026

   Microsoft has not attributed the activity to a nation-state actor, but the campaign’s infrastructure, payload […] The post Fake Microsoft Edge, Kaspersky and Razer Installers Used to Compromise Windows Systems appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .