Counterfeit software installers hit China-based operations across seven sectors
Spoofed vendor sites and per-request payload regeneration mean neither domain reputation nor hash-based detection catches the installer.
TL;DR
Microsoft is tracking an active campaign using counterfeit software-download sites that impersonate trusted vendors to distribute malicious installers. Victims span healthcare, manufacturing, gaming, technology, logistics, government, and education, concentrated among China-based operations and Chinese-speaking users. The campaign, consistent with Silver Fox (Yinhu) activity, regenerates installer payloads server-side per download: same filename, different hash, defeating conventional hash-based detection. Microsoft has not attributed it to a nation-state actor.
The campaign exploits a vulnerability that isn't a CVE: users' trust that a search result for "Razer drivers" or "notepad++ download" will land them on the vendor's actual site. Microsoft observed victims navigating to domains like pc-razerzone[.]com[.]cn, plausible enough at a glance, and downloading installer archives that looked legitimate. What arrived wasn't the software they searched for.
The defining technical signature is per-request payload regeneration. Microsoft's telemetry captured the same archive filename (app_setup.6653004.zip) written twice in roughly 69 seconds with distinct content, indicating server-side generation rather than a static hosted binary. That makes hash-based blocking useless: every download produces a unique file. Delivery infrastructure rotates across domains (gehie246[.]com, yimxg25tiy[.]com, cc8ttkv35b[.]com) and an Alibaba Cloud OSS bucket, while lure pages use .com.cn, .hl.cn, and .cn domains embedding the impersonated brand name.
The technique isn't new. Microsoft has documented similar trust-abuse patterns in the EmEditor supply-chain compromise and Storm-2561's SEO-poisoned VPN installer campaign. But the scale and sector breadth here are notable: seven sectors, multiple organizations, concentrated among China-based operations of multinational firms. Microsoft assesses moderate confidence the activity is consistent with Silver Fox (Yinhu) but stops short of nation-state attribution.
For the practitioner Monday: if your organization permits software downloads from the open web, the control that catches this is SmartScreen with blocking mode enabled, paired with network protection to block connections to low-reputation domains. Tamper protection prevents the malware from disabling Defender after installation. But the uncomfortable reality is that these spoofed pages look convincing, and the installers are signed or packaged to bypass casual scrutiny. The user who downloads a counterfeit Razer installer from what appears to be razerzone.com isn't being reckless; they're being targeted by an adversary that understands how software procurement actually works in large organizations.
Published ·Deep Fathom