New Silver Fox Attack Pushes Malware Through Software Update Lures

**Executive summary:** Silver Fox, a China-linked threat actor active since at least 2022, has expanded from financial crime to combined espionage and opportunistic attacks across Taiwan, Japan and Southeast Asia, using targeted phishing, loader chains (disguised shortcuts/Office macros and cloud-hosted second-stage payloads), a Python-based stealer that exfiltrates artifacts like WhatsApp backup ZIPs, a broad RAT/rootkit toolkit, and sophisticated kernel-level evasion via signed but vulnerable third-party drivers.