New Silver Fox Campaign Uses Fake Tax Audit Alerts and Software Updates to Deliver Malware

Silver Fox, a China-linked threat actor active since at least 2022, has escalated into wide phishing campaigns across Taiwan, Japan and Southeast Asia using fake tax/audit notices and counterfeit software update prompts to deliver RATs, a loader, and a Python-based information stealer. The group employs advanced persistence and EDR-evasion techniques — notably BYOVD using legitimately signed vulnerable drivers — to maintain kernel-level access and exfiltrate sensitive data from medical, financial, and corporate targets; recommended mitigations include stronger email filtering, domain monitoring, driver load controls, kernel-protected EDR, and application whitelisting.