MICROSOFT Defender Experts are tracking a malware campaign utilizing counterfeit software-download websites that impersonate trusted vendor pages to distribute malicious installers. This campaign primarily targets Chinese-speaking users and organizations across various sectors, including healthcare and education. The attack follows a structured chain from spoofed download sites to execution and persistence of malware.
Notable infections originate from dynamically generated installer archives hosted on malicious domains, exhibiting behavior consistent with the Silver Fox campaign. Recommendations for organizations include enabling Microsoft Defender protections and avoiding untrusted downloads to mitigate risks associated with such attacks.