Counterfeit Software Installers Drive New Malware Campaign

Introduction

Microsoft has detailed an active malware campaign that relies on counterfeit software download websites to trick users into installing malicious software. For IT and security teams, the report is a reminder that user-driven software downloads remain a high-risk entry point, especially when attackers closely mimic trusted vendors.

What’s new

Microsoft Defender Experts observed a campaign that:

• Uses spoofed software download pages that imitate well-known brands such as Razer, Microsoft Edge, Kaspersky, and others
• Delivers malicious installer archives from rotating infrastructure and suspected attacker-controlled storage
• Regenerates payloads server-side, meaning the same filename can produce different hashes on each download
• Drops a stage-one payload that establishes persistence, attempts to weaken security protections, and connects to attacker-controlled infrastructure
• Has been detected and disrupted by Microsoft Defender across multiple attack stages, including automated containment

Microsoft said the activity is consistent with the publicly reported Silver Fox fake software campaign, although it has not attributed the operation to a nation-state actor.

Scope and targeting

The campaign primarily affected:

• China-based operations of multinational organizations
• Chinese-speaking users
• Organizations in healthcare, manufacturing, gaming, technology, logistics, government, and higher education

A notable detail for defenders is the use of brand-themed look-alike domains on .com.cn, .hl.cn, and .cn domains. Microsoft also noted that traditional netblock or geography-based blocking may miss related infrastructure, while ASN-level analysis can be more useful for hunting.

Why this matters for administrators

This campaign shows how convincing fake download portals can bypass user caution and lead directly to compromise. Because payloads are dynamically generated and filenames change frequently, static indicators alone may not be enough.

Administrators should focus on layered defenses, including:

• Blocking or restricting downloads from untrusted sources
• Enabling Microsoft Defender SmartScreen
• Turning on network protection
• Ensuring tamper protection is enabled
• Using Microsoft Defender XDR for detection, investigation, and response

Recommended next steps

Security teams should review current browser, endpoint, and download controls and validate that Defender protections are active across managed devices. It is also a good time to educate users to download software only from verified vendor sites or approved internal software repositories.

If your organization has users or operations in affected regions, consider proactive hunting for suspicious installer activity, randomized executable paths, and connections to newly registered or look-alike download domains.