Researchers Trace Fake Installer Campaign Assessed as Consistent with Silver Fox Activity
Summary
Researchers analyzed indicators from a Microsoft-tracked fake-installer campaign assessed with moderate confidence as consistent with prior Silver Fox activity, finding related domains and other artifacts. No nation-state attribution has been made.
Key points
- Microsoft tracked fake software download sites impersonating trusted vendors and distributing malicious installers; China-based operations of multinational organizations were primarily affected.
- Researchers assessed with moderate confidence that the campaign was consistent with previous Silver Fox fake software campaigns, but did not attribute it to a nation-state actor.
- The investigation analyzed nine network indicators: six domains, one subdomain, and two IP addresses.
- Researchers found two typosquatting groups and one domain they assessed as likely registered with malicious intent; it had appeared on a malicious-domains feed 781 days before being identified as an indicator.
- Network traffic data showed two potential victim IP addresses communicating with one campaign-related IP indicator between June 9 and 20, 2026.
- The researchers identified 1,474 email-connected domains; five had been associated with malicious campaigns. They also reported additional IP- and string-connected domains, including some confirmed malicious.
Article Details
- Attack Vectors
- Fake software download sites impersonate trusted vendors and distribute malicious installers to users seeking popular software.
- Two reported domain indicators belonged to typosquatting groups containing three and four domains, respectively.
- The reported malicious subdomain used legitimate shared hosting; the article states that its apex domain had no Threat Intelligence API hits.
- Defensive Notes
- The publisher recommends supplementary investigation to corroborate indicators, warning that entities classified as malicious or threatening could later be deemed harmless.
- The researchers excluded one of the seven original domain indicators after their checks indicated that it belonged to a legitimate entity.
- Treat hosting neighbors and registration-linked artifacts as investigative leads rather than confirmed malicious infrastructure unless independently corroborated.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | ai-claude[.]com[.]cn | Email-connected domain that the researchers' Threat Intelligence API associated with malware distribution since 2026-08-07. |
| DOMAIN | an-razerzone[.]com[.]cn | Research indicator listed as a typosquatting lookalike in the same group as a reported fake-installer domain; maliciousness was not independently confirmed. |
| DOMAIN | app-microsoft-edge[.]com[.]cn | Reported fake-installer domain indicator belonging to a three-member typosquatting group. |
| DOMAIN | app-razerzone[.]com[.]cn | Research indicator listed as a typosquatting lookalike in the same group as a reported fake-installer domain; maliciousness was not independently confirmed. |
| DOMAIN | iualef[.]net | Reported fake-installer domain indicator with 36 historical domain-to-IP resolutions. |
| DOMAIN | kaspersky-lab[.]hl[.]cn | Reported fake-installer domain indicator using a software brand in its name. |
| DOMAIN | oijfwe[.]net | Reported fake-installer domain indicator assessed as likely registered with malicious intent; it appeared in a malicious-domain feed before its designation as an IOC. |
| DOMAIN | pc-microsoft-edge[.]com[.]cn | Research indicator listed as a typosquatting lookalike in the same group as a reported fake-installer domain; maliciousness was not independently confirmed. |
| DOMAIN | pc-razerzone[.]com[.]cn | Reported fake-installer domain indicator belonging to a four-member typosquatting group. |
| DOMAIN | web-microsoft-edge[.]com[.]cn | Research indicator listed as a typosquatting lookalike in the same group as a reported fake-installer domain; maliciousness was not independently confirmed. |
| DOMAIN | zh-razerzone[.]com[.]cn | Research indicator listed as a typosquatting lookalike in the same group as a reported fake-installer domain; maliciousness was not independently confirmed. |
| IPV4 | 202[.]95[.]14[.]237 | Reported IP indicator examined in the fake-installer investigation; historical DNS records showed 1,000 IP-to-domain resolutions. |
MITRE ATT&CK
Threat Actors
Tools
Bulk IP Geolocation LookupWe then queried them on Bulk IP Geolocation Lookup and discovered that while they were both geolocated in China, they had different ISPs.Bulk Registration Risk APIFirst, we queried them on Bulk Registration Risk API and discovered that two domain IoCs appeared in two separate typosquatting groups.DNS Chronicle APIBased on the results of our DNS Chronicle API queries for the domain IoCs, five recorded 98 historical domain-to-IP resolutions over time.Reverse WHOIS APIThis allowed us to unearth 1,474 distinct email-connected domains after those already named as IoCs were filtered out aided by Reverse WHOIS API.Threat Intelligence APIDo note, however, that it is hosted on a legitimate apex domain that has no Threat Intelligence API hits based on the results of our WhoisXML API MCP Server query.WHOIS APINext, we queried the domain IoCs on WHOIS API and found out that:WHOIS History APIWe began by querying the domain IoCs on WHOIS History API and learned that three had three unique public email addresses in their historical records.WhoisXML API MCP ServerWhile we obtained seven domain IoCs from the Microsoft report, we only analyzed six since one was owned by a legitimate entity based on the results of our checks via the WhoisXML API MCP Server.