Counterfeit installers to system compromise: Tracking a deceptive software download campaign | Microsoft Security Blog
Counterfeit installers to system compromise: Tracking a deceptive software download campaign | Microsoft Security Blog
摘要: Search
Research
September 1
18 min read
Counterfeit installers to system compromise: Tracking a deceptive software download campaign
Microsof
正文
Research
September 1
18 min read
Counterfeit installers to system compromise: Tracking a deceptive software download campaign
Microsoft Security Research
Microsoft Defender Experts
Parth Jomadkar
Listen to this post
/
Link copied to clipboard!
Content types
Research
Products and services
Microsoft Defender
Microsoft Defender Experts
Actionable threat insights
Threat intelligence
Microsoft Defender Experts is tracking an active malware campaign that uses counterfeit software-download websites to impersonate trusted vendors and distribute malicious installers. The campaign has targeted users looking to download popular software and has resulted in compromises across multiple organizations and industries, primarily affecting China-based operations of multinational organizations and Chinese-speaking users. Microsoft has observed victims across healthcare, manufacturing, gaming, technology, logistics, government, and education sectors.
Once executed, the malicious installers deploy malware that establishes persistence, attempts to weaken security protections, and communicates with attacker-controlled infrastructure. Microsoft assesses with moderate confidence that this activity is consistent with the publicly reported Silver Fox (also known as Yinhu, 银狐) fake software campaign but has not attributed it to a nation-state actor. Microsoft Defender detected and disrupted activity across multiple stages of the attack, including automated containment through attack disruption. Organizations should prioritize preventing downloads from untrusted software sources and ensure protections such as SmartScreen, network protection, tamper protection, and Microsoft Defender XDR are enabled to help identify, block, and respond to related activity.
Attack chain overview
The campaign follows a consistent attack chain from a spoofed vendor download page to a self-protecting, persistent implant. The stages below trace