At a glance Campaign Counterfeit software-download / fake installer campaign Threat actor Consistent with Silver Fox (Yinhu); moderate-confidence, not nation-state Targets China-based operations and Chinese-speaking users; many sectors Delivery vector Spoofed vendor download sites serving trojanized installers Key capabilities Persistence, SYSTEM privilege abuse, Defender tampering, C2 Source Microsoft Defender Experts TL;DR Attackers built high-fidelity clones of popular software sites. Victims download fake software installers that quietly deploy malware.