Silver Fox Pushes Fake Installers That Kill Windows Update and Weaken Defender

On September 1, 2026, Microsoft published a detailed technical analysis of an active malware campaign targeting multinational operations in China and Chinese-speaking users. The Silver Fox threat cluster, also known as Yinhu (银狐), uses pixel-perfect counterfeit websites of popular software to distribute malicious installers that, once executed, disable Windows Update, weaken Microsoft Defender through PowerShell exclusions, delete volume shadow copies, and modify directory ACLs to prevent removal. The anti-forensics chain is designed to render the compromised machine unrecoverable without direct technical intervention.

Clone-Site Deception Fidelity: When Phishing Outdoes the Original Brand

The spoofed domains identified by Microsoft impersonate recognized brands: pc-razerzone[.]com[.]cn, app-microsoft-edge[.]com[.]cn, kaspersky-lab[.]hl[.]cn, translate-youdao[.]hl[.]cn, zh-diskgenius[.]com[.]cn, baidu-pan[.]com[.]cn, ocam-pc[.]com[.]cn, steelseries-cn[.]com[.]cn, mindmoster[.]com[.]cn. The use of .com.cn and .hl.cn TLDs, combined with Chinese-language lure content, creates a veneer of local legitimacy that lowers user vigilance.

Server-side payload generation marks a qualitative leap over prior campaigns. Microsoft observed that archives with identical names (app_setup.6653004.zip) produced different hashes on downloads 69 seconds apart, while the delivery URL remained constant. This mechanism renders detection based on static SHA-256 hashes — a traditional pillar of perimeter defenses — useless. Randomization also extends to execution paths: the stage-one payload is dropped into directories such as C:\Users\Public\[random]\[random].exe.

The Compromise Chain: From msiexec.exe to Defender Exclusions via SYSTEM

The execution chain uses two primary vectors. The first passes through a wrapper installer that materializes the stage-one payload in randomized paths. The second, observed later, abuses msiexec.exe — the legitimate Windows Installer service — to launch dynamically named executables, exploiting the trust inheritance of a Microsoft-signed process to evade execution controls.

Persistence is achieved via scheduled tasks that mimic IT or productivity jobs, a masquerade pattern that reduces the likelihood of behavioral detection based on naming anomalies. Once persistence is established, the malware elevates privileges to SYSTEM and creates a dedicated scheduled task to configure Microsoft Defender exclusions via PowerShell. This mechanism does not disable Defender outright but selectively nullifies its visibility into the infection chain's paths and processes.

In parallel, the malware deletes volume shadow copies — eliminating the possibility of quick recovery — and modifies payload directory DACLs with icacls to prevent removal by standard users. The ACL hardening, combined with the shutdown of Windows Update services, turns the machine into a blind and mute endpoint: it receives no patches, maintains no restore points, and permits no automated remediation.

The Final Payload: ValleyRAT and C2 Infrastructure on Non-Standard Ports

The post-compromise phase delivers ValleyRAT, a remote access trojan with documented capabilities for keystroke and clipboard capture, active window scanning of analytics applications, system information gathering, screenshots, log deletion, dynamic C2 address updates, and additional module downloads. Kaspersky detailed a specific case where a malicious installer distributed QN Wallpaper, a genuine Chinese tool modified to trigger a DLL sideloading chain leading to ValleyRAT.

The command-and-control infrastructure stands out for its use of eleven non-standard ports: 5090, 7031, 7032, 7088, 7089, 7090, 8050, 28290, and 28300. The two identified C2 domains are iualef[.]net and oijfwe[.]net. Fragmentation across multiple ports and the ability to dynamically update addresses, documented as a ValleyRAT capability, complicate perimeter blocking via firewalls and proxies.

"Microsoft has assessed with moderate confidence that this activity is consistent with the publicly reported Silver Fox (also known as Yinhu, 银狐) fake software campaign but has not attributed it to a nation-state actor" — Microsoft Security Blog

Enterprise Risk: Seven Sectors Hit and a Prolonged Exposure Window

According to Microsoft, confirmed victims span seven sectors: healthcare, manufacturing, gaming, technology, logistics, government, and education. The campaign primarily targeted multinational operations in China and Chinese-speaking users, though the threat's technical structure does not limit its geographic applicability.

The business impact extends beyond single-endpoint compromise. Disabling Windows Update creates an indefinite exposure window: even if the initial payload is contained, the machine remains vulnerable to subsequent patches. The selective weakening of Defender, combined with shadow copy deletion and ACL hardening, erodes the very premises of automated defense. Microsoft stated that Defender triggered automated containment procedures via attack disruption but has not determined the campaign's ultimate objective.

What to Do Now

Microsoft has published specific indicators of compromise, including stable SHA-256 hashes for the stage-one payload (676a2a7b94ca…) and the stage-two payload (6d6ba2bc9ad4…), the latter masked with metadata 'Speech Processing Solutions GmbH' / 'Philips Speech Driver Client Configuration'. Detection must shift from static hashes to behavioral analysis: anomalous parent-child process trees (msiexec.exe spawning randomized executables), mimetic scheduled-task patterns, and modifications to the wuauserv and WaaSMedicSvc services.

Chinese authorities acted against cybercrime cases linked to a new Silver Fox trojan variant in June 2026; Microsoft has not established whether this action is directly related to the campaign under examination or to parallel variants. The dossier does not specify the total number of victims or compromised organizations, nor the precise campaign duration from the first indicator.

The most significant takeaway for defenders is the demonstration that deception fidelity has reached a level where visual site verification is no longer sufficient. Dynamic server-side generation, path randomization, and the abuse of legitimate processes like msiexec.exe constitute a threat profile that demands behavior-based detection, not signatures. The anti-forensics chain — update kill, backup kill, defender blind, hardened persistence — signals a maturation of Silver Fox tactics that drastically reduces the margin for error in endpoint defenses.

Sources

• https://thehackernews.com/2026/09/fake-software-installers-disable.html
• https://research.checkpoint.com/2026/gaming-the-system-how-a-chinese-speaking-actor-turned-brazilian-government-sites-into-an-seo-weapon/
• https://research.checkpoint.com/2026/btr-reforged-weaponizing-defenders-remediation-driver-as-a-kernel-operation-primitive/
• https://www.microsoft.com/en-us/security/blog/2026/09/01/counterfeit-installers-system-compromise-tracking-deceptive-software-download-campaign/
• https://www.guardianmssp.com/2026/09/02/fake-software-installers-disable-windows-update-and-weaken-microsoft-defender/
• https://cybersecuritynews.com/palo-alto-networks-acquires-console/amp/
• https://thehackernews.com/
• https://thehackernews.com/p/upcoming-hacker-news-webinars.html
• https://thehackernews.com/search/label/Threat%20Intelligence
• https://thehackernews.com/search/label/Vulnerability
• https://thehackernews.com/search/label/Cyber%20Attack

Information verified against cited sources and current as of publication.

Sources