Attackers are using spoofed websites impersonating Microsoft Edge, Kaspersky, Razer and other vendors to distribute trojanized installers that establish persistence and weaken security defenses.
Microsoft has warned that attackers are breaching enterprise systems via counterfeit download sites impersonating software including Microsoft Edge, Kaspersky and Razer, delivering trojanized installers for persistent access.
“Once executed, the malicious installers deploy malware that establishes persistence, attempts to weaken security protections, and communicates with attacker-controlled infrastructure,” Microsoft security researchers wrote in a blog post.
The campaign, tracked by Microsoft Defender Experts, has impacted organizations across healthcare, manufacturing, gaming, technology, logistics, government, and education, the company said.
The attackers are using a network of spoofed websites mimicking legitimate vendors, from browsers and security tools to utilities such as Baidu Netdisk, draw.io, and Sejda PDF, to trick users into downloading malicious installers, the blog added.
Microsoft said the attack chain moves “from a spoofed vendor download page to a self-protecting, persistent implant,” turning routine software downloads into a reliable entry point for compromise.
The company added that the activity is consistent with the publicly reported Silver Fox (also known as Yinhu) campaign, though it has “not attributed it to a nation-state actor.”
Look-alike sites and regenerating payloads
The attack begins with fraudulent download pages hosted on look-alike domains, often using .com.cn and .hl.cn naming patterns that embed the impersonated brand, according to the post.
These pages route victims to a shared backend that delivers malicious installer archives. A key feature of the campaign is that the files “keep the same filename while its hash changes on every download,” indicating server-side payload generation, Microsoft said.
That significantly reduces the effectiveness of file-based detection, said Vibhum Dubey, a cybersecurity researcher and red teamer.
“The installer keeps the same filename, but the hash changes with every download. So even if security teams identify and block one sample, the next download can be a different file.”
Abuse of trusted Windows components
Once executed, the installer launches a multi-stage infection chain, beginning with a wrapper that drops a payload to randomized locations on the system, the post said.
In some cases, attackers also use the Windows Installer service to execute payloads through msiexec.exe, allowing malicious activity to run under a legitimate Microsoft-signed process, the researchers noted.
Dubey said that complicates detection because defenders must look beyond the binary itself.
“Using msiexec.exe makes this harder because it is a legitimate, Microsoft-signed Windows component,” he said. “The real question becomes why it was launched, where the MSI came from, and what happened after it ran.”
He added that the technique reflects a broader shift in attacker tradecraft, with adversaries increasingly blending into normal system behavior rather than relying on clearly malicious binaries.
Persistence and defense evasion
After gaining execution, the malware establishes persistence using scheduled tasks that mimic routine system activity, repeatedly launching payloads, Microsoft said.
The attackers then escalate privileges using short-lived scheduled tasks running as SYSTEM to modify Microsoft Defender settings, the post added.
Microsoft also observed multiple defense evasion techniques, including adding antivirus exclusions, deleting volume shadow copies, and disabling Windows Update services.
Dubey said the combination of these techniques is notable:
“The malware adds Defender exclusions, deletes shadow copies, interferes with Windows Update, and uses a temporary SYSTEM-level scheduled task.”
“These actions show that the malware is thinking about the defender as well as the victim. It is trying to make detection harder, interfere with patching, and reduce the chances of recovery.”
He added that while none of the techniques are new individually, combining them in a single chain point to more deliberate tooling.
Later-stage payloads establish command-and-control communication using a mix of dedicated infrastructure and cloud services, including object storage used to stage additional payloads, Microsoft said.
In some environments, the activity included “hands-on-keyboard” actions, suggesting attackers may move beyond automated infection after gaining access, the post said.
Enterprise risk and detection shift
The campaign highlights risks for multinational organizations, particularly where regional differences in software sourcing and IT practices exist.
“For global organizations, China-based offices and subsidiaries can have different software sources, IT practices, and security policies. Those differences can create gaps that attackers can use,” Dubey said.
Because the fake sites closely mimic trusted vendors, users may not recognize the threat. “An employee may simply think they are downloading a familiar product and have no reason to suspect the installer,” he said.
Microsoft urged organizations to focus on behavioral indicators rather than file-based detection, noting that filenames and hashes are intentionally randomized.
Dubey said that shift is becoming essential. “The main takeaway for me is that a file being signed by Microsoft does not make the activity behind it legitimate,” he said. “The context and sequence of actions are becoming much more important than the file hash alone.”