Reported by 2 outlets
SilverFox Malware Campaign Uses Smart Filtering to Hide Fake Software Downloads From Researchers
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.55 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Analysis
SilverFox-linked operators have moved past counterfeit software portals toward delivery infrastructure that distinguishes potential victims from security researchers. Pelagosx investigated a Windows delivery chain that began with a finance-themed WhatsApp message targeting Malaysian users, urging the recipient to forward a report for verification and open an attached ZIP file named PDF_C2841_20260911100446.zip.
Inside the archive, the disk image carried a signed executable next to an unsigned DLL that worked together to run hidden code, a side-by-side sideloading setup that abuses the trust placed in the signed binary. One caveat matters for accurate threat modeling: the published evidence does not show the researcher-specific blocking or smart filtering described in headlines, nor does it establish that this WhatsApp attachment came from a fake software-download site. The visitor-aware filtering claim attributed to this group should be treated as plausible but unconfirmed until someone publishes telemetry for it.
The confirmed tradecraft is still worth attention: valid code-signing certificates paired with DLL sideloading defeat most default detections and fit the pattern of targeted delivery over messaging apps rather than mass phishing. Watch for Pelagosx follow-up analysis that verifies the filtering behavior, additional samples linked to the fake download portals, and whether the signed-binary abuse moves to other regions beyond Malaysia.
Timeline
-
original reporting
SilverFox Malware Campaign Uses Smart Filtering to Hide Fake Software Downloads From Researchers
cyberpress.org · 14d ago · September 29th, 2026
The message urged the recipient to forward a report for verification and open an attached ZIP file on a computer. Its disk image carried a signed executable and an unsigned DLL that worked together to run hidden code. The supplied evidence does not show the “smart filtering” or researcher-specific blocking described in the headline. It also does not establish that this WhatsApp attachment came from a fake software-download site. Those claims should not be treated as findings of this investigation. SilverFox Hides Fake Downloads The WhatsApp attachment was named PDF_C2841_20260911100446.zip . Inside its IMG disk image, researchers found PDF_C2089_20260911100446.exe beside active_desktop_render_x64.dll . Windows reported a valid signature for the executable from Guangzhou Kugou Technology Co., Ltd. Its metadata identified it as a KuGou launcher. The unsigned DLL instead used metadata resembling a Microsoft Desktop Window Manager component. Reverse engineering showed that the launcher directly calls the DLL’s SetDesktopMonitorHook() and ClearDesktopMonitorHook() exports. WhatsApp delivery of PDF_C2841_20260911100446.zip . The finance-themed message instructs the recipient to forward the report for verification and open the attachment on a computer (Source: pelagos) The first call enters an obfuscated initialization routine. That routine resolves Windows functions using hash-like identifiers, decodes data with XOR, transforms a 0x2bc0-byte region and copies the result into execut
-
update from gbhackers.com
SilverFox Built Fake Software Sites That Know When Researchers Are Watching
gbhackers.com · 14d ago · September 29th, 2026
SilverFox-linked operators are evolving beyond counterfeit software portals and signed-binary abuse by using visitor-aware delivery infrastructure that can distinguish potential victims from security researchers. Pelagosx recently investigated a related Windows malware delivery chain that began with a finance-themed WhatsApp message targeting Malaysian users. The message urged recipients to forward a report for verification and open […] The post SilverFox Built Fake Software Sites That Know When Researchers Are Watching appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .