Fake installers target Windows update, Defender

A campaign using counterfeit software-download sites has been observed luring users into installing malware that ultimately disables Windows Update and erodes Microsoft Defender protections, according to Microsoft. The Windows maker said the attacks have already compromised systems across multiple organizations and industries, with a primary focus on China-based operations of multinational companies and Chinese-speaking users.

"The campaign has targeted users looking to download popular software and has resulted in compromises across multiple organizations and industries, primarily affecting China-based operations of multinational organizations and Chinese-speaking users," Microsoft said.

A familiar threat behind a known trick

The campaign's technical fingerprints point to a Chinese threat cluster Microsoft tracks as Silver Fox, also known as Yinhu. Microsoft says it has assessed with moderate confidence that the activity is consistent with Silver Fox, which has previously been caught using spoofed vendor download pages to push Gh0st RAT and ValleyRAT, also called WinOS 4.0.

The latest wave uses lookalike sites that closely mirror the legitimate pages of trusted software vendors, complete with download buttons and Chinese-language lures. The observed domains are hosted on .com.cn and .hl.cn infrastructure and include names such as app-microsoft-edge[.]com[.]cn, kaspersky-lab[.]hl[.]cn, and zh-diskgenius[.]com[.]cn, among others.

The sites distribute a ZIP archive from "gehie246[.]com" — a payload that is generated server-side for every request, as evidenced by the archive keeping the same file name while its hash changes on each download.

Two paths to the same payload

Once opened, the archive reveals a wrapper installer — examples Microsoft observed include "a_instapp83353001.exe" and "ainst8663586104.exe" — that executes the first-stage payload when run. Separately, Microsoft noted a second execution vector that abuses the trusted Windows Installer service, "msiexec.exe," to launch a randomized executable, mirroring the same masquerade pattern as the wrapper chain.

Victims span healthcare, manufacturing, gaming, technology, logistics, government, and education sectors, Microsoft said.

Making Windows easier to compromise

Persistence is achieved through scheduled tasks that mimic routine IT or productivity jobs. The malware also creates a short-lived scheduled task that runs as SYSTEM and configures Microsoft Defender exclusions via PowerShell, deletes volume shadow copies, and ensures payload directories cannot be removed by standard users by modifying their discretionary access control lists (DACLs) using icacls.

In addition, it tampers with Windows Update by stopping and disabling wuauserv, UsoSvc, uhssvc, and WaaSMedicSvc, renaming update dynamic-link libraries (DLLs), and deleting the SoftwareDistribution cache. This effectively prevents the system from receiving critical updates that could otherwise thwart the malware's activities.

Connecting back to the attackers

After these steps, the malware establishes command-and-control (C2) over application-layer protocols on non-standard ports like 5090, 7031, 7032, 7088–7090, 8050, 28290, and 28300. Two C2 domains associated with the activity are "iualef[.]net" and "oijfwe[.]net."

Microsoft said its Defender detection capabilities initiated automated containment procedures through attack disruption to limit the attack's impact further. The end goal of the campaign remains unclear, the company noted.

A pattern of abuse

The disclosure arrives days after Kaspersky detailed a separate malicious installer that deploys a modified Chinese desktop wallpaper management tool known as QN Wallpaper, using it to initiate a DLL sideloading chain responsible for delivering ValleyRAT.

"The original version of QN Wallpaper is genuine adware: on installation, it delivers bundled partner apps to the device and then displays ad banners to the user," Kaspersky said. "In this case, however, the attackers use it to carry out DLL sideloading, a technique that allows malicious code to run under the guise of a signed process by way of a malicious DLL."

That backdoor captures keystrokes and clipboard contents, saving them to a file on disk. It also periodically scans for active windows belonging to applications that could be used to analyze processes or traffic, and takes steps to protect its own process from being terminated.

ValleyRAT's reach and attribution

ValleyRAT itself is a sophisticated implant with features that allow it to collect system information, reboot or shut down the computer, take screenshots, wipe logs, update C2 addresses, download additional DLL or shellcode modules, and send keylogger logs along with clipboard data.

"The attackers exploited a well-known adware application to run the backdoor under the guise of a signed process, which complicates detection," Kaspersky said. "Motivated by both cyber espionage and financial gain, Silver Fox targets organizations across multiple countries."

Separately, a report published by Expel last month attributed the use of ValleyRAT to a sub-group within GoldenEyeDog known as CuboidalCanine, which is assessed to have moved away from Gh0st RAT "at some point." CuboidalCanine, per Expel, targets the gambling industry and uses watering holes to distribute the malware, abusing code-signing certificates to bypass security controls.

Security researcher Aaron Walton noted the complexity of attribution. "This malware isn't unique to any actor, but has been known to be used by GoldenEyeDog," Walton said. "Due to the source code being public, attribution of this malware to any actor relies on factors other than the malware family itself."

Disruption against a known adversary

Microsoft's write-up includes a call to action for organizations to harden their environments, including enabling cloud-delivered protection and automatic sample submission, turning on tamper protection, and investigating with Microsoft Defender XDR hunting queries.

In June 2026, Chinese authorities took action against a series of cybercrime cases distributing a new variant of the Silver Fox trojan, state media outlet China Daily reported.

Why this matters for defenders

The campaign's tactic of disabling Windows Update and adding Defender exclusions is a potent combination — it strips away the very mechanisms that would likely detect or remediate the infection. For security teams, this means that even well-maintained endpoints can be silently crippled if an attacker gains initial execution, underscoring the importance of restricting administrative privileges and monitoring for changes to Windows services and security settings.

This also suggests that organizations with China-based operations or Chinese-speaking users are at higher risk, and that vigilance around software downloads — even from sites that look like official vendor pages — is essential. The use of server-side payload generation and non-standard C2 ports further complicates detection, making it imperative for defenders to rely on behavioral monitoring and automated disruption capabilities.

As the campaign continues to evolve, the shift toward disabling core security features could mark a troubling trend, raising the stakes for any organization that depends on Windows Update and Defender as a baseline defense.