Silver Fox Hackers Disable Microsoft Defender via Fake Software Installers
Hackers linked to the Silver Fox (Yinhu) campaign are compromising Windows systems by distributing fake software installers that disable Microsoft Defender and other security measures.
Cybercriminals associated with the Silver Fox, also known as Yinhu, campaign are employing a sophisticated social engineering tactic to compromise Windows systems. The attackers are distributing malicious software through convincing, look-alike websites that impersonate popular software vendors. These counterfeit sites lure unsuspecting users into downloading fake software installers, which then proceed to disable critical security defenses, including Microsoft Defender.
The attack chain begins with users visiting spoofed websites designed to mimic legitimate vendors such as Razer, Microsoft Edge, Kaspersky, and Sejda PDF. When a user attempts to download software from these sites, they are provided with a ZIP archive. To evade detection, the contents and hash of these archives are dynamically generated for each download, making traditional file-based blocking less effective. This dynamic generation is a hallmark of advanced malware distribution campaigns, aiming to bypass static security signatures.
Upon opening the malicious archive, a wrapper deploys an executable file into a randomly named directory. In some instances, the malware leverages the Windows Installer (msiexec.exe) to execute malicious code through a trusted Windows component, further masking its presence. This technique allows the malware to run under the guise of a legitimate software installation process, increasing the likelihood of successful execution.
Once established, the malware focuses on weakening system defenses. It creates scheduled tasks with innocuous names to ensure persistence, often restarting malicious code every 60 seconds. Crucially, it establishes a SYSTEM-level scheduled task to add broad exclusions to Microsoft Defender. This is achieved through PowerShell commands that exclude specific folders and modify code-integrity policies, significantly reducing the system's ability to detect and block the malware.
Beyond disabling antivirus, the campaign actively hinders recovery and detection efforts. Researchers have observed the malware deleting volume shadow copies, a critical step in making system recovery more difficult for affected organizations. Additionally, it attempts to stop or disable Windows Update services, preventing the system from receiving vital security patches and updates. The attackers also harden their malicious directories against removal and communicate with command-and-control servers using non-standard ports.
The campaign has a broad impact, affecting organizations across various sectors including healthcare, manufacturing, gaming, technology, logistics, government, and education. While many observed victims have ties to China-based operations or are Chinese-speaking users, the deceptive nature of the lures can attract a wider audience. Microsoft analysts have noted that the observed activity is consistent with the publicly reported Silver Fox campaign, though no nation-state attribution has been made.
To mitigate these threats, organizations are advised to restrict software downloads to verified vendor sources and treat any unexpected ZIP installers from brand look-alike pages with extreme suspicion. Implementing robust web and email filtering to block identified delivery routes is crucial. Security teams should actively monitor for suspicious activities such as new executables in writable folders, unusual msiexec.exe behavior, recently created scheduled tasks, and changes to Defender exclusions or update services. Enabling tamper protection and network protection within Defender is also recommended.
Ultimately, the success of this campaign hinges on user behavior and the ability of attackers to mask their malicious activities. Defenders must prioritize hunting for the sequence of events: a spoofed-page download, a randomly staged executable, SYSTEM task creation for defense tampering, and recurring execution. For end-users, the primary defense is to avoid opening questionable installers and to obtain software directly from official publishers, reporting suspicious sites to IT or security personnel.