SilverFox

SilverFox, also known as Yinhu, is a Windows-focused remote-access Trojan ecosystem used in campaigns primarily targeting Chinese-speaking users and organizations. Operations have used spoofed software-download websites, SEO poisoning and watering-hole delivery, and instant-messaging spearphishing to distribute malware masquerading as legitimate software installers or business-themed documents. The activity has impersonated widely used productivity, remote-access, browser, security, and communications products.

SilverFox-related payloads employ DLL side-loading, staged in-memory payload execution, process injection and process hollowing, anti-debugging and virtual-machine evasion, code and configuration obfuscation, and security-tool impairment. Observed functions include host, process, file, and directory discovery; credential and email collection; keylogging; screen and clipboard capture; persistence through startup mechanisms, scheduled tasks, and services; and command-and-control-based data exfiltration. Some variants use RPC-based command-and-control communications and encrypted payloads or configuration data.

SilverFox activity has been associated with ValleyRAT, Winos 4.0, Gh0stRAT-derived tooling, HoldingHands, UTG-Q-1000, VoidArachne, and ValleyThief. Public reporting identifies overlap among these tools, but operator-level attribution remains unresolved.