Silver Fox Tax Audit Phishing Campaign Shifts from RATs to Python Stealers

This report details Silver Fox (Void Arachne) tax-themed phishing campaigns from 2025–early 2026 that evolved across three waves: initial ValleyRAT infections via malicious PDFs, later abuse of a legitimately signed Remote Monitoring and Management (RMM) binary to hide C2 parameters, and a final wave using a compiled Python stealer disguised as a WhatsApp backup utility; campaigns targeted organizations across China, Taiwan, Japan, Malaysia and broader South/Southeast Asia and included modular backdoors, signed-binary abuse, and bespoke stealers with observable IOCs.