Fake Microsoft Edge, Kaspersky and Razer Installers Used to Compromise Windows Systems

An active malware campaign that abuses counterfeit download pages for trusted software brands including Microsoft Edge, Kaspersky and Razer to compromise Windows devices.

Victims span healthcare, manufacturing, gaming, technology, logistics, government and education, highlighting the broad appeal of software-download lures.

Microsoft has not attributed the activity to a nation-state actor, but the campaign’s infrastructure, payload delivery model and layered defense-evasion techniques demonstrate a mature, persistent operation.

The campaign starts with high-fidelity fraudulent websites impersonating legitimate vendors.

Observed lure domains include app-microsoft-edge[.]com[.]cn, kaspersky-lab[.]hl[.]cn, and pc-razerzone[.]com[.]cn, alongside look-alikes for Calibre, SteelSeries, Sejda PDF, DiskGenius, Baidu Netdisk and other commonly downloaded applications.

The sites mimic branding and use prominent “Download now” controls to persuade victims to retrieve installer archives.

Microsoft observed a fake Razer download page redirecting users to gehie246[.]com/712down, which delivered an archive named app_setup.6653004.zip.

A notable evasion feature is server-side payload regeneration: the archive filename and delivery URL can remain unchanged while the file’s contents and cryptographic hash change with each download.

Microsoft Researchers said that, the operation, assessed with moderate confidence as linked to the publicly reported Silver Fox, or Yinhu, campaign, has primarily affected China-based operations of multinational organizations.

Windows Users Targeted

Microsoft recorded two content-distinct copies of the same archive written less than 70 seconds apart.

Commercial hosting and DNS providers carrying substantial unrelated tenancy, so the ASN and nameserver should be treated as hunting pivots, not blocklist entries.

This model frustrates simple hash-based blocking. Instead, defenders should correlate browser download telemetry especially FileOriginUrl and FileOriginReferrerUrl with look-alike domains, recurring archive-name families, and delivery paths such as /712down, /73inst, /7qinst, and /ins711.

After a victim extracts the ZIP file, a bundled wrapper installer launches a stage-one executable in randomized directories, often under C:\Users\Public\<random>\ or C:\Program Files (x86)\<random>\.

Although filenames and paths vary, Microsoft observed stable payload content across multiple executions, enabling behavior- and hash-based detection.

The attack chain commonly appears as Microsoft Edge downloading the archive, followed by 7-Zip, WinRAR or 360Zip extracting it, then an installer executable launching the randomized payload.

A parallel delivery path abuses the trusted Windows Installer component: msiexec.exe runs in embedded mode and writes a payload into C:\Users\Public\, giving the malware execution under a signed Windows binary.

Later-stage files masquerade as legitimate software. Microsoft found one payload claiming to be a Philips Speech Driver Client Configuration binary, complete with forged version metadata, while running from a random directory and filename.

Another component impersonated Indigo Rose TrueUpdate Client and used its update-like behavior to retrieve additional payloads from an Alibaba Cloud Object Storage Service bucket over TLS.

Persistence is established through scheduled tasks with plausible but unusual names, such as “Deadline Mission Target” and “Hierarchy Tools Smooth Inventory.”

These tasks repeatedly launch payloads from C:\ProgramData\, creating a recognizable roughly 60-second execution cadence on affected machines.

The malware also creates short-lived SYSTEM-level scheduled tasks to add Microsoft Defender exclusions, then deletes those tasks to reduce forensic evidence.

Other observed defense-evasion actions include deleting shadow copies with vssadmin, modifying file permissions, stopping Windows Update services, renaming Windows Update DLLs, clearing the SoftwareDistribution cache, and writing a malicious Windows Defender Application Control policy.

Microsoft further detected process injection through CreateRemoteThread, with a persistent payload injecting into a legitimate user application shortly after it launched.

Command-and-control traffic used unusual ports including 5090, 7031, 7032, 7088–7090, 8050, 28290 and 28300, while cloud storage remained available as a staging channel when dedicated C2 infrastructure was unreachable.

Microsoft Defender detected activity across delivery, execution, task creation, Defender tampering, C2 communications and SMB lateral-movement attempts.

Attack Disruption automatically contained affected devices and accounts in qualifying incidents, though organizations still need to remove persistence and investigate possible hands-on-keyboard activity.

Organizations should block software downloads from unofficial sources, enforce Tamper Protection, enable SmartScreen and Network Protection, and deploy Defender XDR controls.

Microsoft also recommends Attack Surface Reduction rules that block low-prevalence executables, obfuscated scripts, copied or impersonated system tools, and ransomware-related behavior.

The campaign underscores a familiar but increasingly sophisticated risk: trusted software names are being weaponized as the initial-access mechanism, while per-download payload regeneration and trusted Windows utilities help attackers bypass traditional controls.

IOCs

Campaign Layer	Indicator	Type
Lure / Impersonation	pc-razerzone[.]com[.]cn	Domain
Lure / Impersonation	app-microsoft-edge[.]com[.]cn	Domain
Lure / Impersonation	kaspersky-lab[.]hl[.]cn	Domain
Delivery	hxxps://www.gehie246[.]com/712down	URL
Delivery	gehie246[.]com	Domain
Cloud Staging	newopt001.oss-cn-hongkong.aliyuncs[.]com/innstll.1.0.61.zip	URL

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.