MICROSOFT Defender Expertshave detailed a campaign in which attackers deploy counterfeit software installers via spoofed vendor download pages, designed to resemble legitimate brands and lure Chinese-speaking users and organisations across multiple sectors. The entry points are cloned download sites with domains often ending in .com[.]cn or .hl[.]cn, each displaying a prominent “Download now” button that redirects to a shared delivery and payload infrastructure.
The fake installers use the same archive filename but vary the file hash with each download, a technique Microsoft says indicates server-side payload generation and defeats simple hash or filename blocklists.
Once a victim downloads and extracts the malicious archive, a wrapper installer launches a stage-one payload, which then relocates to a random path on the host while retaining a stable payload. Microsoft also observed a second execution path through the Windows Installer service (msiexec[.]exe in embedded mode), dropping a randomized payload under a trusted Windows component.
The malware uses disguised version metadata to masquerade as legitimate software and persists by creating scheduled tasks with innocuous names, relaunched by Task Scheduler to achieve a roughly 60-second re-execution cadence, including a SYSTEM-level task for privileged actions and Defender exclusions. It also performs process injection into a trusted user application.
Defence evasion includes Defender path exclusions, SYSTEM registry writes, deletion of volume shadow copies, and stopping Windows Update to hinder recovery. Later-stage payloads reach attacker-controlled command-and-control via non-standard ports, with a six-character .net domain tier and TLS connections to Alibaba Cloud object storage as a resilient staging mechanism. Microsoft attributes the activity to Silver Fox (Yinhu) with moderate confidence, noting it stops short of attributing to a nation-state actor.
Organisations are advised to block downloads from untrusted sources, update Defender protections, and hunt for odd scheduled tasks or Defender exclusions.