A Windows machine inside one of the organizations Microsoft monitors visited what looked like Razer's download page, pulled the file twice, and got two different ones. Same name, app_setup.6653004.zip, roughly 69 seconds apart, different contents. The page was not Razer's. It was pc-razerzone[.]com[.]cn, one of roughly twenty counterfeit vendor sites that Microsoft Security Research, Microsoft Defender Experts and Parth Jomadkar say are feeding malware to people who believe they are installing ordinary software.
The archive is rebuilt for every visitor. That is the trick.
Microsoft Defender Experts describes an active campaign with victims across healthcare and medical devices, manufacturing, gaming, technology, logistics, government and higher education. Affected devices were predominantly associated with China-based operations of multinational organizations and with Chinese-speaking users, matching the Chinese-language lures and the .com.cn and .hl.cn domains behind them. Microsoft assesses with moderate confidence that the activity is consistent with the publicly reported Silver Fox (Yinhu) fake software campaign, and has not attributed it to a nation-state actor.
A different file every time you click
The defining characteristic, in Microsoft's words, is that the archive keeps the same filename while its hash changes on every download, a strong indicator the payload is generated server-side, per request. Look-alike pages for Kaspersky, Microsoft Edge, Baidu Netdisk, draw.io, Sogou, SteelSeries and Calibre all funnel to the same handful of delivery hosts.
Inside is a wrapper installer with a generated name such as a_instapp83353001.exe, which drops a stage-one payload into a randomized directory under a world-writable path like C:\Users\Public\. The names are random, the content is not: the same SHA-256 turned up under many names and locations. A second route reaches the same place through msiexec.exe, handing the operators execution under a signed Windows component. The payloads borrow other identities too, one declaring itself Philips Speech Driver Client Configuration from Speech Processing Solutions GmbH, while its version resource still carries an unfilled build template placeholder where the product name should be.
Then it turns the repairs off
Persistence comes from scheduled tasks named to imitate routine IT jobs: Deadline Mission Target, Hierarchy Tools Smooth Inventory. Several staggered tasks run per device, so infected hosts re-execute roughly every 60 seconds. The follow-on payloads then work on the machine's defenses in layers. They add Microsoft Defender path exclusions through PowerShell covering C:\, C:\Users and C:\ProgramData, and to write one with the privileges it needs, the malware creates a short-lived scheduled task that runs as SYSTEM, executes it, then deletes it. It deletes volume shadow copies to inhibit recovery, locks its own directories with icacls so a standard user cannot delete the files, and neutralizes Windows Update by stopping and disabling wuauserv, UsoSvc, uhssvc and WaaSMedicSvc, renaming the update DLLs and deleting the SoftwareDistribution cache. On several devices it also wrote a malicious Windows Defender Application Control policy to the code integrity store.
Block the source, not only the payload
Microsoft's guidance is to prioritize preventing downloads from untrusted software sources, and to ensure SmartScreen, network protection, tamper protection and Microsoft Defender XDR are enabled. Not all of this is automated: in some environments it came with interactive, hands-on-keyboard work.
For hunting, reported delivery traffic includes hxxp://www[.]gehie246[.]com/712down, served from spoofed pages such as pc-razerzone[.]com[.]cn and kaspersky-lab[.]hl[.]cn, with callbacks to 47[.]239[.]232[.]245:8050, 103[.]156[.]25[.]35:7031 and 103[.]183[.]3[.]162:5090. Microsoft notes the dedicated command and control tier was often unreachable while the same payloads still reached attacker-controlled cloud object storage over TLS, so a quiet C2 does not mean a quiet host.
The shape is familiar. Kaspersky recently found a backdoor inside a signed Chinese wallpaper app, and researchers showed in August how counterfeit download pages survive the hover check and the signature check. What connects them is an assumption about users: that people find software by searching for it, and trust the first page that looks right. Our China threat profile tracks the wider activity.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.