Microsoft disclosed a campaign on 1 September 2026 distributing malware through high-fidelity clones of legitimate software vendor sites. Victims arrive by searching for the software they wanted.

The spoofed list is long and ordinary: Microsoft Edge, Baidu Pan, Calibre, Draw.io, Sogou, Kaspersky Lab, MindMeister, OBS Studio, Razer, Sejda, SteelSeries, Youdao Translate, DiskGenius. The clones sit on .com.cn and .hl.cn domains with Chinese-language content.

What the installer does next is the part worth studying.

It does not disable Defender. It makes the exclusion permanent.

The malware sets Defender exclusions through PowerShell — that is routine. Then it modifies the discretionary access control lists using icacls so that a standard user cannot remove them.

That is the step that changes the story. An exclusion a user can delete is a temporary problem. An exclusion protected by an ACL the user lacks permission to edit is a configuration change that survives the user noticing it.

This is the same actor Microsoft assesses — with moderate confidence, which is worth preserving — as Silver Fox (Yinhu). We wrote about them hiding ValleyRAT inside signed adware that users voluntarily added to their own exclusion lists. Same objective, opposite direction: there the victim created the hole, here the malware creates it and then welds it open.

Windows Update is broken, not disabled

The installer stops and disables four services — wuauserv, UsoSvc, uhssvc and WaaSMedicSvc — deletes the SoftwareDistribution cache, and then renames the update DLLs.

Disabling a service is reversible by anyone who knows where to look, and it looks like tampering. Renaming the libraries the update stack loads produces a machine where Windows Update fails with errors that look like corruption.

That distinction is operational, not cosmetic. A user who suspects tampering calls security. A user whose updates are throwing file-not-found errors calls the helpdesk, and the ticket gets triaged as a broken machine. The attacker has bought weeks of unpatched Windows and an incident that is not classified as one.

Volume shadow copies are deleted. Persistence runs through scheduled tasks named to resemble legitimate IT jobs.

There is no hash to block

Archives download from gehie246[.]com with filenames matching the real software — and the hash changes on every request, which means payloads are generated server-side per download.

Hash-based indicators are therefore useless here by design, and so is any control built on them. The durable indicators in this campaign are behavioural: services stopped, DLLs renamed, exclusions written, ACLs modified.

Command and control runs over application-layer protocols on non-standard ports — 5090, 7031-7032, 7088-7090, 8050, 28290, 28300 — to domains including iualef[.]net and oijfwe[.]net.

What Microsoft does not say

Microsoft states plainly that it is unclear what the end objective is, because Defender detected the activity and initiated automated containment before the campaign got there.

That is an unusual and useful admission. Most write-ups of a campaign this elaborate assert a purpose. This one says the operation was interrupted and the destination is unknown, and leaves it there.

Affected sectors span healthcare, manufacturing, gaming, technology, logistics, government and education, primarily affecting China-based operations of multinational organisations and Chinese-speaking users — which means it is not a regional problem for anyone with a China presence.

What to do

  • Alert on icacls modifying ACLs on Defender configuration. That is not an action a legitimate installer takes.
  • Monitor the four update services as a set. wuauserv, UsoSvc, uhssvc and WaaSMedicSvc being stopped together is a signature; individually they are noise.
  • Treat "Windows Update is broken" as a security ticket, at least once. This campaign is built on it being triaged as an IT fault.
  • Audit exclusion lists for entries nobody added. The list is an inventory of your blind spots either way — we have said this before about the version where the user adds them.
  • Do not build detection on file hashes here. They rotate per download.
  • Block the software-download-by-search behaviour where you can, with an internal software portal. Every victim in this campaign went looking for a legitimate product.

What is not established

  • The end objective. Microsoft says so itself.
  • The attribution. Silver Fox at moderate confidence, based on prior use of spoofed vendor pages delivering Gh0st RAT and ValleyRAT. Moderate is not high.
  • How many victims. No figure is given.
  • Whether the campaign is still live or the infrastructure has moved.
  • Whether the same operator runs the QN Wallpaper adware route documented separately by Kaspersky, or whether both are drawing on shared tooling.