A DNS Deep Dive into a Silver Fox-Style Fake Installer Campaign
Microsoft Defender Experts¹ is tracking an active campaign that uses counterfeit software download sites to impersonate trusted vendors. Users looking for popular programs download installer archives that deliver malware instead. The malware sets up persistence, weakens security protections, and calls back to attacker-controlled infrastructure. Microsoft says the activity resembles the reported Silver Fox campaign but has not attributed it to a nation-state actor.
The original analysis published 10 network IoCs. We investigated nine of them with the WhoisXML API MCP Server², after setting one domain aside as legitimately owned.
Original IoCs Analyzed
Domain and IP indicators from the reported campaign
Key Findings
Email-connected domains
Additional IP addresses
IP-connected domains
Malicious artifacts
These are key highlights from our analysis. The full report contains many more findings and detailed insights.
OUR RESEARCH PROCESS
- Domain IoC legitimacy check
- Subdomain IoC hosting analysis
- Domain IoC typosquatting, WHOIS, and DNS history analysis
- IP IoC geolocation and traffic analysis
- Email- and IP-connected domain discovery
- String-connected domain discovery and malicious artifact confirmation
Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.
—
- [1] https://www.microsoft.com/en-us/security/blog/2026/09/01/counterfeit-installers-system-compromise-tracking-deceptive-software-download-campaign/
- [2] https://main.whoisxmlapi.com/ai/mcp-server
Latest Reports
DNS Spotlight: BigBear 2.0 PhaaS Targets Span 40+ Countries
WhoisXML API uncovered 1,600+ additional artifacts linked to BigBear 2.0. Download the threat research materials now.
A DNS Investigation of the ASCII Smuggling Phishing Campaign
WhoisXML API uncovered 100+ additional artifacts linked to the ASCII smuggling phishing campaign. Download the threat research materials now.
1,677 Domains Referencing Superintelligence, 739 Registered in a Single Day.
WhoisXML API uncovered 1,677 domains referencing superintelligence. Download the threat research materials now.