Counterfeit installers to system compromise: Tracking a deceptive software download campaign

Strategic summary

Microsoft Defender Experts is tracking an active malware campaign that uses counterfeit software download websites to impersonate trusted vendors and distribute malicious installers. The campaign primarily affects China-based operations of multinational organizations and Chinese-speaking users, with confirmed incidents across healthcare, manufacturing, gaming, technology, logistics, government, and education. It follows a consistent attack chain from spoofed download pages and dynamically generated installers to persistent malware that evades defenses and communicates with attacker-controlled infrastructure. Microsoft assesses with moderate confidence that this activity is consistent with the publicly reported Silver Fox campaign, but has not attributed it to a nation-state actor.

Key findings

• Fraudulent download pages impersonate legitimate vendors such as Razer through domains like pc-razerzone.com.cn and redirect users to rotating delivery hosts, including a suspected attacker-controlled Alibaba Cloud OSS bucket.
• The malicious installers are dynamically regenerated server-side: two content-distinct copies of the same archive name were observed on a single device within 69 seconds.
• After execution, the malware establishes persistence, attempts to weaken security protections, and communicates with attacker-controlled infrastructure; Microsoft Defender automatically blocked and disrupted attack steps.
• Affected industries include healthcare, manufacturing, gaming, technology, logistics, government, and higher education, with China-based operations of multinational organizations and Chinese-speaking users primarily targeted.
• Microsoft assesses with moderate confidence that the activity is consistent with the publicly reported Silver Fox campaign, without attribution to a nation-state actor.