Silver Fox Uses Fake Microsoft Teams Installer to Spread ValleyRAT Malware in China

The Hacker News reports that the threat actor Silver Fox has been conducting a false-flag operation to mimic a Russian group in attacks against organisations in China, using a search engine optimisation–driven (SEO) poisoning campaign that leverages Microsoft Teams lures to deliver ValleyRAT (Winos 4.0).

The campaign, which has been active since November 2025, targets Chinese-speaking users, including those within Western organisations operating in China, and uses a modified ValleyRAT loader with Cyrillic elements to mislead attribution, according to ReliaQuest.

The lure redirects victims to a bogus website where a ZIP file named MSTчamsSetup[.]zip is downloaded from an Alibaba Cloud URL, containing Setup.exe, a trojanised Teams installer that configures Defender exclusions and writes additional components to AppData before launching the final payload. ValleyRAT provides remote control capabilities, data exfiltration, and persistence, and the researchers note that the campaign marks a shift from prior campaigns that used other software to activate the infection chain.

The disclosure includes statements from ReliaQuest and references to Nextron Systems’ findings on related ValleyRAT attack chains, with analysts describing the operation as a sophisticated effort to maintain plausible deniability.