An active malware campaign using fake software download websites to impersonate well-known vendors demonstrates how effective social engineering remains when attackers combine it with trusted Windows utilities and deliberate security-control tampering. Microsoft says the campaign has compromised organizations across healthcare, manufacturing, gaming, technology, logistics, government and education, with activity primarily affecting China-based operations of multinational organizations and Chinese-speaking users. Microsoft assesses with moderate confidence that the campaign is consistent with Silver Fox, also known as Yinhu, a threat cluster previously associated with the distribution of Gh0st RAT and ValleyRAT through spoofed software-download pages. The attackers have created convincing copies of websites associated with software and brands such as Microsoft Edge, Baidu Pan, Calibre, Draw.io, Kaspersky, Razer, SteelSeries and DiskGenius. The objective is straightforward: convince users who are actively searching for legitimate software that they have arrived at the vendor's genuine download page, and then have the victim voluntarily execute the initial malware installer. 

The campaign is particularly effective because it does not begin with an obvious exploit or suspicious email attachment. The victim is already looking for software, finds what appears to be the correct website and chooses to download the application. Some of the counterfeit sites closely reproduce the legitimate vendor's appearance and prominently display what looks like a normal download option. Microsoft observed that downloaded ZIP archives could retain the same filename while producing a different cryptographic hash for each download, indicating that the malicious payloads may be dynamically generated on the server. This technique can complicate traditional hash-based blocking because every victim may receive a slightly different executable. Once the archive is opened, a wrapper installer launches the first-stage payload. Microsoft also observed another execution path that abuses the legitimate Windows Installer utility `msiexec.exe` to execute randomized payloads. The attackers are therefore not trying to replace the Windows execution environment; they are deliberately operating through trusted components wherever possible so that malicious activity resembles normal system behaviour.

Disabling the Defences Is Part of the Infection Process 

What makes this campaign more concerning than a conventional malicious installer is what happens immediately after execution. The malware does not simply establish persistence and contact its command-and-control infrastructure. It systematically attempts to weaken the endpoint's ability to protect or recover itself. Persistence is created using scheduled tasks with names designed to resemble legitimate IT or productivity tasks. Another temporary scheduled task executes with SYSTEM privileges and uses PowerShell to configure Microsoft Defender exclusions, effectively instructing the endpoint protection platform to ignore directories containing attacker-controlled components. The malware then deletes volume shadow copies and modifies discretionary access control lists using `icacls`, preventing ordinary users from deleting the directories where its payloads are stored. These actions demonstrate a deliberate attempt not only to remain persistent but also to make removal and recovery substantially more difficult.

The attack goes further by directly interfering with Windows Update. The malware stops and disables services including `wuauserv`, `UsoSvc`, `uhssvc` and `WaaSMedicSvc`, renames Windows Update DLLs and deletes the SoftwareDistribution cache. This is strategically important because disabling Windows Update does more than prevent the current malware from being removed. It gradually weakens the machine against future vulnerabilities as well. A compromised endpoint that can no longer receive security updates becomes progressively easier to exploit over time. The manipulation of WaaSMedicSvc is particularly notable because the Windows Update Medic Service exists specifically to repair Windows Update components when they become damaged or disabled. In effect, the malware is not merely switching off Windows Update; it is interfering with the mechanisms Microsoft uses to restore the update subsystem itself. This should be considered a high-confidence behavioural indicator of compromise because legitimate enterprise software rarely needs to simultaneously disable multiple update services, rename update components and remove update caches.

This behaviour also illustrates why endpoint security cannot rely only on malware signatures. PowerShell, Task Scheduler, `msiexec.exe`, `icacls` and Windows service-management functions are all legitimate administration tools. An attacker does not need to introduce a suspicious custom utility if Windows already provides the required capability. Security products therefore need to evaluate sequences of behaviour rather than individual commands in isolation. A scheduled task being created may be legitimate. PowerShell modifying a configuration may also be legitimate. A Windows service being stopped is not necessarily malicious. But when a newly downloaded executable creates SYSTEM-level scheduled tasks, adds Defender exclusions, removes shadow copies, changes ACLs, disables multiple Windows Update services and establishes outbound communications within a short period, the combined activity provides a much stronger indication of compromise. This is where endpoint detection and response systems, behavioural analytics and network-level monitoring become considerably more valuable than simple file reputation.

Trusted Software Is Increasingly Being Used as Camouflage 

The same broader campaign ecosystem also demonstrates another increasingly common technique: DLL sideloading using legitimate signed applications. Kaspersky recently documented a related malicious installer that deploys a modified version of QN Wallpaper, a legitimate Chinese desktop wallpaper application, and then abuses it to load a malicious DLL. Because the executable launching the DLL is legitimate and signed, the malicious activity can initially appear to originate from trusted software. The resulting ValleyRAT payload can capture keystrokes and clipboard data, take screenshots, gather system information, erase logs, download additional DLLs or shellcode, update command-and-control addresses and perform other remote-access operations. The malware also attempts to identify active applications associated with process or network analysis, suggesting an effort to determine whether security researchers or defensive tools are observing its activity.

This technique highlights an important weakness in security strategies that place excessive trust in signed applications. A valid digital signature confirms who signed a particular executable and provides integrity protection for that file; it does not guarantee that everything the executable subsequently loads is trustworthy. DLL sideloading takes advantage of how Windows applications search for dependent libraries, allowing attackers to place a malicious DLL where a legitimate application will load it. The resulting process may still have the filename, icon and digital signature of trusted software while executing attacker-controlled code inside its process context. Application reputation therefore needs to be combined with monitoring of module loads, child-process behaviour, network communication and unusual filesystem activity. Treating "signed" as equivalent to "safe" is increasingly inadequate.

Software Downloads Have Become a Supply-Chain Problem for the User 

The broader lesson from this campaign is that organizations need to reconsider how users obtain software. Security teams traditionally focus heavily on phishing email, malicious attachments and exploitation of internet-facing services. Fake software distribution sites occupy an uncomfortable middle ground because the user voluntarily initiates the interaction. Search results, online advertisements, software forums and links shared through messaging platforms can direct employees to convincing copies of trusted vendor websites. The resulting malware installation may therefore bypass some traditional email-focused security controls entirely. Organizations should encourage or enforce installation through managed software repositories, enterprise application catalogs or verified vendor locations rather than permitting employees to independently search the internet for installers. Application allowlisting can further reduce risk by preventing unknown executables from running simply because a user downloaded them.

DNS and web filtering can also provide useful control points because the infection requires communication with attacker-controlled infrastructure before and after execution. Microsoft observed command-and-control communications using application-layer protocols over unusual ports including 5090, 7031, 7032, 7088 through 7090, 8050, 28290 and 28300. Unusual outbound traffic from desktop systems should therefore receive greater scrutiny, particularly when it follows execution of a newly downloaded installer. Organizations that implement egress filtering can substantially constrain this attack model by preventing ordinary endpoints from establishing arbitrary outbound connections. The same principle applies to DNS monitoring: newly registered or suspicious domains impersonating popular software vendors can often be identified before endpoint malware signatures are available.

Defenders should also monitor for unexpected Microsoft Defender exclusions, deletion of volume shadow copies, modification or disabling of Windows Update services, changes to the SoftwareDistribution directory, unusual SYSTEM-level scheduled tasks, suspicious use of `msiexec.exe`, and ACL modifications affecting newly created directories. These behaviours should be correlated rather than evaluated independently. If an endpoint unexpectedly loses Windows Update functionality, administrators should not simply repair the service and consider the issue resolved. Multiple update services being disabled simultaneously may indicate that the machine was deliberately tampered with, and the appropriate response may therefore be compromise investigation rather than ordinary troubleshooting.

The User Is Still Part of the Security Boundary 

Perhaps the most important aspect of this campaign is that the initial compromise does not necessarily require the attacker to defeat Windows security. The attacker first convinces the user to execute the malware, then uses legitimate Windows functionality to weaken the controls that might otherwise detect or remove it. This is a useful reminder that endpoint protection operates after a series of trust decisions have already occurred. The user trusts the search result, trusts the website, trusts the download, trusts the installer and authorizes its execution. Attackers only need to make each individual step look sufficiently ordinary.

Organizations therefore need controls that reduce the number of security decisions individual users are expected to make. Employees should not routinely need to determine whether `microsoft-edge-something.com.cn` is actually Microsoft, whether a downloaded ZIP archive is legitimate or whether an unfamiliar installer should be allowed to execute. Centralized software distribution, application control, DNS filtering, endpoint behavioural monitoring and restricted administrative privileges move those decisions away from individual users and into enforceable security policy.

The Silver Fox activity demonstrates how modern malware campaigns increasingly combine social engineering with living-off-the-land techniques. The fake installer is only the entry point. Once running, the malware attempts to reshape the Windows environment in its favour by creating persistence, excluding itself from Defender, damaging recovery mechanisms, disabling Windows Update and establishing command-and-control communications. The objective is not simply to evade one security product but to progressively reduce the endpoint's ability to defend, update and recover itself.

That is the more important warning from this campaign. Attackers are increasingly not trying to "break" security controls in the traditional sense. They are using legitimate administrative functionality to reconfigure those controls until the system stops protecting itself.

For organizations, the response should therefore extend beyond telling employees not to download suspicious software. Software acquisition itself needs to become a controlled security process. When users have to search the open internet for installers, attackers are effectively being invited to participate in the organization's software supply chain, and unfortunately they seem rather enthusiastic about the opportunity.

An active malware campaign is using bogus software-download websites to impersonate trusted vendors and distribute malicious installers. "The campaign has targeted users looking to download popular software and has resulted in compromises across multiple organizations and industries, primarily affecting China-based operations of multinational organizations and Chinese-speaking users," Microsoft

Source: Fake Software Installers Disable Windows Update and Weaken Microsoft Defender via The Hacker News — published 02 Sep 2026.