A DNS Deep Dive into a Silver Fox-Style Fake Installer Campaign
Microsoft Defender Experts¹ is tracking an active campaign that uses counterfeit software download sites to impersonate trusted vendors. Users looking for popular programs download installer archives that deliver malware instead. The malware sets up persistence, weakens security protections, and calls back to attacker-controlled infrastructure. Microsoft says the activity resembles the reported Silver Fox campaign but has not attributed it to a nation-state actor.
The original analysis published 10 network IoCs. We investigated nine of them with the WhoisXML API MCP Server², after setting one domain aside as legitimately owned.
Original IoCs Analyzed
Domain and IP indicators from the reported campaign
Key Findings
Email-connected domains
Additional IP addresses
IP-connected domains
Malicious artifacts
These are key highlights from our analysis. The full report contains many more findings and detailed insights.
OUR RESEARCH PROCESS
- Domain IoC legitimacy check
- Subdomain IoC hosting analysis
- Domain IoC typosquatting, WHOIS, and DNS history analysis
- IP IoC geolocation and traffic analysis
- Email- and IP-connected domain discovery
- String-connected domain discovery and malicious artifact confirmation
Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.
—
- [1] https://www.microsoft.com/en-us/security/blog/2026/09/01/counterfeit-installers-system-compromise-tracking-deceptive-software-download-campaign/
- [2] https://main.whoisxmlapi.com/ai/mcp-server
Latest Reports
Earth Sirrush Espionage Tool Evolution: DNS Facts Unveiled
WhoisXML API uncovered 400+ additional artifacts linked to Earth Sirrush. Download the threat research materials now.
Four hours before PHP2Shell’s Disclosure
A server scouted our honeypots 4 hours before PHP2Shell’s disclosure, then returned with exploit attempts. The report covers its traffic history and IoCs.
APT36 Deploys Multiple Malware in RapidRust: A DNS Investigation
WhoisXML API uncovered 300+ additional artifacts linked to Operation RapidRust. Download the threat research materials now.