Silver Fox Targets Indian Users With Tax-Themed Emails Delivering ValleyRAT Malware

The threat actor known as Silver Fox has turned its focus to India, using income tax-themed lures in phishing campaigns to deliver a modular remote access Trojan called ValleyRAT (also known as Winos 4.0). This sophisticated operation employs a complex kill chain, including DLL hijacking, to ensure persistence, according to CloudSEK researchers Prajwal Awasthi and Koushik Pal.

Infections are spread via decoy PDFs purportedly from India’s Income Tax Department; opening the attachment leads to a zip file tax affairs[.]zip and a NSIS installer that uses the thunder.exe component and a rogue libexpat.dll to load the ValleyRAT payload into a hollowed explorer.exe process.

ValleyRAT can command a remote server, offer a plugin-oriented architecture for features such as keylogging and credential harvesting, and uses registry-resident plugins with delayed beaconing to survive reboots, per NCC Group. The attackers also operate an exposed link management panel, ssl3[.]space, to track downloads of backdoor installers for various apps and to measure click activity from regions including China, the U.S., Hong Kong, and others, with infections dating back to July 2025.

In addition, NCC Group notes that the campaign has spread dozens of backdoor installers impersonating well‑known services like Microsoft Teams, OpenVPN and Telegram across Asia-Pacific, Europe and North America.